hello my name is Stephanie Rizzo and I'm the senior product manager for third-party risk management and service now I have over 12 years of experience within the third party risk management domain and I'm here to present servicenow's new products third party risk management on my agenda today is what is a third party risk we'll go through the product vision and roadmap and then I'm going to give you a quick look into our new Vancouver product for third-party risk management we have a vendor risk management solution and the difference between a vendor risk management solution and a third-party risk management solution is a type of information that we have within it vendor risk management is going to manage vendors and suppliers these are vendors that provide goods and services that are used in the production or delivery of a company now all vendors are third parties but third parties aren't all vendors now a third party is any company or individual that an organization has entered into a business relationship with or has some kind of interactions with there does not need to be any kind of contract or money exchange in place for this third party to expose your agency to risk so it's important that you don't just look at suppliers but you also potentially look at your legal services manufacturers logistical services and some of your outsourced operations and how they may expose your agency to risk in this new third-party product our main focus is going to be on our engagements now the way we Define engagements within the third party risk management solution is it is going to be the definition of the specific product that has been provided by the third party the service or any interactions with that third party that could expose your or your organization to risk so why are these important well in order to effectively manage all your interactions and ensure that you're sending out the right risk questionnaires and your risk assessing these different engagements properly you need to make sure that you properly scope the risk based on what that third party is doing for you do they have access to some of your sensitive data do they have access to buildings do they represent you to the public is a reputational risk what exactly are these third parties performing and doing for you now the one thing is is that working with third parties is very complex when you take a look at a third party they may offer you multiple different products or services or different types of engagements so it's important to have a holistic view of every way that you're interacting with these third parties for example this particular government agency has in their hierarchy here just three third parties as an example the first one the Tech Machine Company they're going to do consulting services for data management consulting they're also going to do supplying of bi software and they're also going to supply you data storage the type of risk that they expose you to by providing you Services servers to to just store your data is completely different than them having people managing your data because those people have access to that information as you can see that there's a significantly different type of um risk that a company that provides weapon systems to you then a supplier that provides servers so as you look at all of these different types of relationships that you may have with your third parties is important to better understand what they're doing for you the future of third party risk management at surface now is going to empower Enterprises to succeed by solving these new challenges so we need to keep track of all of the third parties not just the suppliers and we need to risk assess all of those third parties and create a single source for all those third parties so we can get a holistic view of how we're interacting with these third parties in the new solution the first thing that we're going to do is encourage you to bring in all of your third parties and risk assess them once you have a starting score and this will be included in the base pricing this way you can see which third parties you may want to continuously monitor in the future that could do some sort of damage to your reputation your assets or get access to sensitive data out of the box we're providing comprehensive risk due diligence workflows now these new due diligence workflows will allow you to allow employees to request to do due diligence on a new third party to handle renewals so that you can make sure that you go through all of the proper due diligence steps if you're going to consider to renew a legal services team or renew some software it's going to manage multiple levels of approvals because it's important typically to involve cross-departmental teams to ensure that they all accept the risk of pre bringing in this new third party also this will allow you to assess multiple different risk domains for a holistic risk view so you may want to look at the reputational damage or reputational risk your operational risk your Financial Risk and potentially looking at the I.T risk that they expose you to we're going to have improved visualizations of our third parties we'll have what's called a concentration risk map so that you can visualize all the third parties across the world by engagements we'll also have a new workspace for you to manage your due diligence tasks and effectively manage and what process your different third parties are in during their onboarding renewals and off-boarding processes and to see if they've been stopped at any one place for any length of time so you can actively manage to ensure they keep going through the process we have an integrated approach for working in service now where you can bring in your incidences about your third parties if you go with some of our other Solutions like Legal Services delivery you can see if there's any conflict of interest to deal with a third party which is very important that governments don't have a conflict of interest when they hire on a new third party this will also help with connecting to your BCM if you'd like you can bring in Risk intelligence information so these are industry scores from companies such as bid site security scorecard in the future we'll bring in Risk screening and sanctions list screening some of these things will be slated for further off than August now go through the roadmap in a second we will have 50 plus out of the box sample questionnaires to give you an idea of some types of questions that you can ask based on the different domains or different regions of the world now this is our overall roadmap to cover when we'll be bringing in these capabilities in August we'll be bringing in the full due diligence life cycles workflows for onboarding due diligence additional due diligence renewals and off-boarding our work space enhancements for being able to better manage these different workloads will be included and a Geo map for concentration risk so you can see all of these engagements across the world we're also going to have some assessment enhancements so that you have more control over what due diligence you send out to your third parties and the ability to send these different contractors to a legal risk approver or allow them to see all the information in one place so bringing in that legal team or those Contracting people whether it's your procurement teams or your legal team we'll also have risks and controls at the engagement level because we're going to become a more engagement focused solution for Washington we're going to focus on doing some ongoing due diligence and bulk assessments which will allow you to send out groups of Assessments or questionnaires based on particular scoping criteria that you set up such as I want all of my third parties in California to receive this particular questionnaire whether that's five of them or seven thousand of them it will recognize them and you can go ahead and send out those questionnaires you can have that scheduled and send set on a watcher Trigger or do it manually in Xanadu and Yokohama we're going to bring in some additional assessment capabilities and sanction screening we'll also be working bringing together some more Integrations with some of our internal Solutions such as a digital portfolio management and s-spom capabilities I'd like to give you a quick look at what's going to come this August in Vancouver so in Vancouver we're going to have the ability for you to allow the different employees to request due diligence through the employee portal you'll simply do this by going into the employee portal and then you can do a third-party due diligence request for if you want to onboard a due diligence for a new engagement that will then give you the ability to to provide the information needed first you select a third party if you want to just do additional due diligence so this is if you want to do some um unexpected due diligence that's maybe off schedule because we do have schedulers and you want to go ahead and off schedule do some additional due diligence on a third party for some reason renewals these can be set up for if a third party maybe you want to manually go out here and say I want to start the renewal process 120 days instead earlier versus 90 days earlier you can go ahead and you can start that process and when you want to end the life of a third party you can go ahead and off-board them without any due diligence because no matter what um they've done for you that project has ended so you don't need their services anymore or you can offer them with due diligence the purpose of this is is your you would like to off-board them but you still have services that are needed you want to make sure it's the right choice to offboard them so you're going to do some due diligence to make sure that this isn't going to have any impact to your business the workflow will be a nice visualization for you to be able to see all of the details this is an onboarding request for a new engagement you'll be able to see the details the inherent risk assessments that are associated the third party risk assessments all of the approvers that are associated to this particular Road class in the risk intelligence scores now the risk intelligence scores are those scores that are coming in from like a bit site security scorecard in tarot's what this is is this is a new page for you to go ahead and see how all of the different workflows are running so if you're managing your different um third parties you're going to be able to see how many of them have been requested and are in process you're going to be able to see your work stream for how many third parties are in the irq process which is an internal assessment for someone to scope out what due diligence needs to get sent out you'll be able to click on the due diligence and see how many third parties are going through the due diligence process and then go ahead and drill down into those to see how many questionnaires have been sent out how many have been completed and you can see if they've been stuck in one place for maybe 144 days you might want to contact that person and find out exactly why they're unable to move forward and approve that in this particular situation but if it was stuck in due diligence you could see why they haven't completed these assessments the purpose of this is so that you can visually see where the bottlenecks are in the process so you can keep things moving on the bottom here we have some aging reports so you'll be able to see how many third parties are in the due diligence process for a certain length of time of zero to Thirty Days 30 to 60 days up to 90 days or over 90 days and you'll be able to drill down and get a list of the third parties so it's just a different way of visualizing this information and allows you to see things based on Aging now this is really exciting this is our risk concentration map the most concentration map will allow you to see all of your third-party engagements across the world you'll be able to map them out based on their risk levels and filter them out by the third party so if you have one third party that has 30 different engagements you'll be able to see all of those different engagements for that particular third party across the world and it also the different colored dots will change based on the risk level you could filter these out by type of third parties or type of Engagement so if you wanted to see all of your suppliers and where they're located if you want to see where all of your it Outsourcing is done you'll be able to see that quickly and easily on the map this is one of the reasons why we're hailing for do you need to bring in all of your third party into our system and score them at least once so that you can map them out and see where everything is throughout the world thank you for your time once again I just wanted to thank you for watching my presentation and for seeing what we have to come this August