Governing Third-Party Information Risk

Third-party information risk has become a board-level governance issue. Effective governance requires a clear view of residual exposure.

• Move Beyond Activity Reporting: Vendor reviews, assurance reports, questionnaires, contracts, insurance, remediation, and exception routing help track program execution, but they rarely show total residual information risk, financial exposure, deviations from established norms, peer alignment, concentration risk, retained risk, transferred risk, or required action.
• Convert Inputs Into Residual Exposure: A governance model should convert third-party risk inputs into a consistent view of residual exposure, confidence, tolerance alignment, concentration, financial impact, retained risk, and transferred risk.
• Measure Exposure Against Appetite and Tolerance: Governing third-party information risk requires measuring residual exposure, validating coverage and confidence, comparing exposure to defined appetite and tolerance, explaining deviations, aggregating risk, benchmarking against peers, and evaluating treatment and transfer.
• Clarify Management and Board Accountability: Management operates the governance model by maintaining the measurement approach, applying thresholds, validating coverage, identifying concentrations, evaluating treatment and transfer, and reporting material exposure, while the board or risk committee oversees whether the model is credible and aligned to appetite.

• In a new HITRUST paper, Governing Third-Party Information Risk, Founder and Executive Chairman Dan Nutkis examines how organizations can move beyond vendor review activity and toward a governance model that measures residual exposure, validates coverage and confidence, compares exposure to defined appetite and tolerance, explains deviations, aggregates risk, benchmarks against peers, and evaluates treatment and transfer.