Same supplier. Different risk.
Every third party a company works with needs a category, and the category decides how closely it gets checked. The people choosing it are rarely compliance specialists, so third-party risk management depends on training them well.
The challengeThird-party risk categories, chosen by non-specialists
Categorising third parties is a key part of how a company manages them, and of its fight against bribery and corruption. It applies any time someone uses a third party for business purposes, so it lands with people across the business, not only the compliance team. The rules were sound. What people needed was a short refresher that turned them into decisions they would recognise: ten minutes, and on a phone if that’s where they had the time.
What we deliveredA 10-minute third-party risk refresher
- 1Third-party risk management training: a 10-minute, mobile-friendly eLearning refresher on how to categorise third parties.
- 2Three key principles, request, intent and the greatest risk principle, each on a card people open to discover.
- 3A video in nine short parts on the third party categories.
- 4Two scenarios, each with its own quiz: a well known supplier, once used for aircraft sales, now brought in for spare parts; and a new supplier gathering information on the defence industry in a country called Fantasia, who meets public officials along the way.
The idea, and why it workedTwo scenarios, one supplier, different risks
Categorisation sounds like paperwork, so we set it inside projects that were already moving. In the first scenario, a supplier you know well comes back for different work, and the question is whether its old category still holds. In the second, a well-connected supplier starts promising more than he was hired to do, and the question is what you do when you notice. The principles come first, on three cards. Then the scenarios ask people to use them on a decision that looks like their own week.
Ten minutes is enough when every minute is a decision someone could face on Monday.
