Third party risk management

We provide advisory services to help you design and build a fit-for-purpose target operating model tailored to your organisation’s needs, ensuring operational compliance with regulatory requirements and protecting stakeholder trust in your organisation.

The model would help to address 3 important aspects in your third party risk management:

• People - Roles and responsibilities
  
• Process - Risk management processes through your third party management lifecycle
  
• Tools - Enablers to standardise and streamline your risk management activities such as, guidance or templates to support risk assessment, materiality assessment, due diligence, exit management, and more
  

We are also here to support you in your journey to optimise your third party risk management programme through technology integration to drive an effective programme.

We can provide support in the operations of your third party risk activities in pre-onboarding, ongoing monitoring and exit management of your third party arrangements, such as:

• risk and materiality assessment and mitigation based on nature of arrangements;
  
• due diligence on third parties based on risk exposure, for example third party security control review, business continuity management process in third parties, ability of third party to meet regulatory requirement such as MAS Technology Risk Management Guidelines, etc;
  
• third party independent assessment including intra-group arrangements reviews, on-site visits, remote visits, etc;
  
• service terminations and offboarding assessment such as controls related to data disposal, service transitioning, return of asset, etc.
  

Our pay-per-use service model can help your organisation to manage volume of risk management activities and optimise cost of operations while achieving a consistent, standardise and quality executions.

We can provide support to assess and enhance service provider’s readiness/maturity against relevant industry best practices and applicable regulations such as ISO, NIST, MAS TRM Guidelines, etc. We help service providers take stock of their current environment and advise them on ways to bring their maturity to the next level.

PwC can provide the following services:

• Assess the service provider’s environment against various regulatory requirements and industry standards (MAS TRM Guidelines and Notices, OSPAR, NIST, ISO, etc.);
• Assess the service provider’s maturity against relevant industry practices (Cyber Maturity, etc.).