How to develop a risk assessment programme for your vendor's BCP capabilities and their impact on your organisation

Abstract

The paper discusses the inherent risk of relying on critical third-party service providers and how customer organisations would be affected if those vendors experienced an incident or disaster. Not all companies could recover from a devastating event like September 11th or a major hurricane, epidemic or pandemic. Indeed, without viable business continuity planning (BCP), many enterprises would simply go out of business. This is one reason why a company's vendors should all have a feasible BCP, regardless of company size. Those companies that do not plan sufficiently for an incident/disaster will be much less likely to recover if such a disastrous event befalls them. The case is made for developing an enterprise-wide vendor management programme that has BCP assessments as a key component, and is covered with process considerations and real-world examples. Identifying these risks and sharing this information with an organisation's senior management is essential to enhance risk mitigation strategies regarding vendor BCP risk.