PORTLAND, Ore.--(BUSINESS WIRE)--Leading ethics and compliance software and services company NAVEX Global® today announced the release of its 2017 Ethics & Compliance Third-Party Risk Management Benchmark Report. While concerns about third-party risk remain high – particularly regarding cyber security – more than half of organizations (58%) ranked their programs as maturing or advanced.
“We continue to see a move toward centralized and automated systems, which allow organizations to treat third parties the same way they treat their own employees with access to hotlines, training and policies,” said Randy Stephens, J.D., Vice President, NAVEX Global. “This is a smart approach, especially given the top concerns we see each year – even if some of those stated concerns fluctuate based on compliance failures in the headlines and shifting regulatory pressures.”
Forty-nine percent of respondents said cyber security and data protection was their top concern this year. This is the first time cyber security was the top concern in this annual report with a 10 percentage point increase from the 2016 survey. Bribery and corruption was the second most-common concern at 42 percent, ahead of conflicts of interest (the top choice in the 2016 survey) at 34 percent.
“There appears to be a fluidity in what respondents believe is the highest risk – even if the top three choices remain fairly consistent,” said Stephens. “Cyber security is always a major concern. But bribery and corruption has also been in the news of late. This issue is particularly significant for large organizations, given the regulatory guidance in the Foreign Corrupt Practices Act – which organizations are increasingly using to inform into their programs.”
While survey respondents identified cyber security as the top concern overall, bribery and corruption was still the #1 issue among organizations with more than 5,000 employees and annual revenues of $1 billion or more. Bribery and corruption was also a greater concern among organizations where 20 percent or more of their annual revenue is related to or generated by their third parties.
Bribery and corruption was more of a concern in Europe, the Middle East and Africa (65%) and Asia-Pacific (64%) than it is in North America (32%). Conversely, North American organizations were far more concerned with cyber security (56%) than their counterparts in Europe the Middle East and Africa (39%) or Asia-Pacific (28%).
The number of third-party partners, and the complexity of the business relationships, has grown considerably for most organizations in recent years. According to Michael Volkov, former federal prosecutor and CEO of The Volkov Law Group, LLC. “Organizational size and geography play a large role in determining what keeps executives up at night. It has become increasingly necessary to automate third-party risk assessment and mitigation using a robust compliance management system.”
Other key findings include:
- Organizations consider more third parties to be “high risk.” This year, only 3 percent of respondents report having no “high risk” third-parties compared to 25 percent in 2016
- More organization plan to increase expenditures for third-party programs than in 2016 (41% versus 33%) – a positive sign given the increased concerns
- Maturing and advanced programs are more fully embracing the guidance of the Foreign Corrupt Practice Act, the UK Bribery Act and other law and regulations. This allows programs to benefit from a risk-based, educated approach to managing their risks
- Organizations that rank their programs as highly effective in all 12 effectiveness categories in the survey also indicate that they utilize third-party automation or software
- Programs employing third-party systems and automation are more likely to utilize effectiveness measures. But for many organizations, there is room for improvement when it comes to assessing program effectiveness
About the Survey Methodology
This year’s Third Party Risk Management Benchmark Report survey instrument was informed by the Evaluation of Corporate Compliance Programs questions developed by Hui Chen as the Compliance Counsel Expert at the Fraud Section in the Criminal Division of the Department of Justice in February, 2017. Section 10 of the questions explores the role of third-parties, and having integrated, risk-based processes in place that correspond to the nature and level of the enterprise risk these third parties present.
“Our report survey has always focused on identifying areas of compliance risk that are of the most concern to respondents,” said Carrie Penman, NAVEX Global Chief Compliance Officer & SVP, Advisory Services. “These areas are, not coincidentally, the same as those subject to Hui Chen’s questions.”
“NAVEX Global's benchmark report is illuminating in demonstrating that there remains room for improvement for companies to assess the effectiveness and efficiency of their third-party management programs in measurable evidentiary terms," said Hui Chen, formerly of the Department of Justice and now an independent speaker and consultant.
To download NAVEX Global’s Ethics & Compliance Third-Party Benchmark Report, please click here.
About NAVEX Global
NAVEX Global's comprehensive suite of ethics and compliance software, content and services helps organizations protect their people, reputation and bottom line. Trusted by 95 of the FORTUNE 100 and more than 12,500 clients, our solutions are informed by the largest ethics and compliance community in the world. For more information, visit www.navexglobal.com.
Learn more about NAVEX Global (www.navexglobal.com) online: Ethics & Compliance Matters™ Blog (http://www.navexglobal.com/blog/), @NAVEXGlobal (twitter.com/navexglobal), LinkedIn (www.linkedin.com/company/navex-global), Facebook (www.facebook.com/NAVEXGlobal) and SlideShare (www.slideshare.net/NAVEXGlobal).