|
|
|
Citicus ONE's customizable risk scorecards allow you
to ‘unpack’ supplier risk to focus on:
- Risks associated with your relationship with a particular supplier
- Risks associated with a specific supplied service / product.
These can be combined with information about the risks to
IT systems that support supplied services through Citicus ONE’s unique
dependency risk mapping and consolidated reporting to give an overview of the
risks across the whole supply chain.
Supplier risk scorecards probe five risk factors as illustrated below: |
|
| |
|
|
|
| |
|
 |
|
Criticality: Identifying the potential impact of incidents on the
quality, cost and delivery of services or products supplied
Control weaknesses*: eg in contractual arrangements, relationship
administration, service delivery, service assurance, exit strategy.
Special circumstances* that can drive risk up: eg the maturity,
viability, geographic location of suppliers
Level of threat*: eg from disputes, poor performance, misconduct,
business interruption
Business impact: The impact of actual supply chain incidents in
financial, reputational, operational and other ways.
|
*These risk factors can be assessed at varying levels of detail by employing
Citicus ONE’s drill-down checklists. For example the geographic
location of suppliers may be further probed to identify risks from
unreliable power/telecommunications, political unrest, strikes, environmental events,
etc.
Citicus ONE has pre-configured content optimized for probing these
supplier risk factors based on industry best practice, developed in
conjunction with Citicus’ customers with high levels of expertise in supply
chain risk management. This built-in content can be easily customized to
match an organization’s specific requirements and standards. For example
this could include:
- The BITS Framework for Managing Technology Risk for Service Provider Relationships
- The FFIEC Outsourcing Technology Services standards
- Data privacy requirements imposed on suppliers
- Guidance from Basel II, Intellect, OGC, ISO/IEC, OCC and others.
The results of risk assessments of suppliers and supplied services are presented
using Citicus ONE’s graphical reporting process. Examples are shown below
and on the Results produced pages.
Reporting compliance of an individual supplied service
against required standards
Providing a league table of the relative criticality
of suppliers and the services they provide
Tracking actual incidents affecting supplied services
| 
