Finding contracts in the wild: a good start for managing ESG and other third-party risks

Related to: Nuix NEO Data Privacy , Nuix Workstation

Written by Oliver Harvey

 

The COVID-19 pandemic has shown many organizations how much they rely on third parties in their supply chains, to help them deliver services and products to customers. At the same time, the growth in environmental, social, and governance (ESG) concerns has forced many organizations to re-visit the commercial relationships they have with third parties whose behaviors may create risks for the organizations’ ESG goals and commitments.

THIRD-PARTY RISKS

Deloitte recently surveyed the third-party risk management practices of over 1000 organizations in more than 30 countries. It found that since COVID-19 became a global pandemic on 11 March 2020, just over half (51%) of respondents faced one or more third-party risk incidents. These incidents created regulatory, reputational, or strategic issues for respondents in areas such as:

• Cybersecurity and privacy issues in third parties
• Failure by third parties to meet their contractual obligations to those organizations
• ESG issues in third parties, such as environmental pollution, modern slavery, bribery, and corruption.

Unsurprisingly, the experiences of the past 24 months have also sharpened regulators’ interest in businesses' arrangements with their third-party vendors. Regulators have often been quick to remind those businesses that they remain ultimately responsible for meeting their obligations to customers and regulators, and where they rely on third parties, it’s their job to manage the third parties to ensure those obligations are met. Some regulators have gone as far as to require businesses to include in their third-party contracts, rights for the business to conduct ongoing audits and continuity assessments of their external vendors. The reasons for doing this are borne out in a recent McKinsey study which showed that while most third-party disruptions occur lower down in the supply chain, two-thirds of companies say they can’t confirm the business continuity arrangements with their non-tier-one suppliers.

 

STEPS TOWARD BETTER RISK MANAGEMENT

An important foundational step towards managing these increasing third-party risks for any organization is to have an up-to-date and comprehensive management system for all the contractual arrangements the business has with these external parties.

Our experience though, is that this is not always as easy as it sounds. Particularly for large organizations, contracts aren’t always where they should be.

Even if you are organized enough to put all your contracts in one place, can you say for sure the document in your central repository is the final version? Or is that the contract the vendor sent a couple of days later after final negotiations with the legal team? Is it the computer-readable Microsoft Word version or the signed-and-scanned PDF emailed back to the other party?

 

FINDING CONTRACTS, WHEREVER THEY’RE HIDDEN

Nuix recently worked with a large bank in the United States that was grappling with this challenge.

The bank needed to improve its risk management of third-party vendor contracts. Over time, each business unit developed its own practices for managing third parties which led to considerable differences across the bank on standard contract language, different approaches to third-party risk management, and material variances in approaches to ongoing due diligence. Different approaches in the contracts to pricing were also an issue, with the situation almost certainly leading to commercial value being left on the table.

To deal with this, the bank was looking to centralize all its contracts into a single third-party management system. But over time, many contracts had been stored by staff amongst terabytes of data in difficult-to-search locations such as employees’ inboxes or shared drives.

The bank’s contract management team knew it couldn’t just run a search for “contract” across all employees’ emails, file shares, and other data repositories. Instead, it used the Nuix Data Finder plugin to run a series of detailed search queries relating to common contract terms across each business unit’s systems.

Nuix Data Finder rapidly trawled the bank’s systems – running optical character recognition to capture scanned documents – and extracted text and metadata from items across the network. This allowed the contract management team to analyze responsive items in real-time and flag any real contracts for further analysis.

Real-time search results helped them fine-tune their search queries to improve the accuracy of detection for each system they analyzed. The bank then extracted the most recent versions of each confirmed contract and migrated it into the management system for ongoing administration. In doing so, Nuix helped the bank rapidly take steps to start dealing with its operational and strategic third-party risk exposure.

 

RE-ENERGIZING THIRD-PARTY RISK MANAGEMENT

Managing third-party risks is a growing concern. Over half of Deloitte’s survey respondents agreed that because of recent and ongoing global events, they need to increase their focus on third parties and make at least some major investments to re-energize their third-party risk management programs. In similar findings from a recent global study by KPMG, 77% of the 1263 risk professionals surveyed believed overhauling their third-party risk management model was overdue.

Re-energizing third-party risk management can take many forms. There is, for example, an increasing appetite among businesses to have much more real-time data on the performance of their third-party vendors. These are longer-term goals for businesses and the technology to deliver these outcomes is still at an early stage. A key stage along this journey is for all businesses to have a complete understanding of the current arrangements they have with their third parties and there’s a readily available technology to help handle that key foundational step.