Tom is a trusted advisor on procurement and third-party management to organizations across the United States. Having worked with over 120 organizations over his 30-year career, he has a unique ability to bring creativity and discipline to finding solutions for even the most complex challenges his clients face.I recently participated in an Exit Readiness podcast that two of my colleague’s host. You can find the podcast here if you want to give it a listen. I have to say this provided me an opportunity to explore the importance of third-party risk management and the wide-reaching implications which are uncovered when you are considering buying or selling a business.
Of course, there are the core areas of business valuation that all companies focus their attention on like:
- Does the company have unique intellectual property and product/services to support sustainable revenue growth?
- Does the company have an experienced and effective leadership team?
- Does the company have disciplined operations and financial management controls in place?
- Does the company have a solid human resources team in place to ensure they are attracting and maintaining an investment in human capital necessary for the company to grow and succeed?
As you would expect, there are a great deal of resources dedicated to the areas of revenue production (sales), expense management (finance) and people management (human resources). The question we help companies grapple with is “how do they control and mitigate the risks associated with working with third-party vendors, suppliers and consultants?” While many companies may be investing an equal amount of capital in relationships with these third parties, most companies are still not making a formal investment in third-party risk management.
Third-party risk management is the process where an organization monitors and manages interactions with all external parties they have a relationship with which may include both contractual and non-contractual parties. These relationships include all vendors, suppliers, consultants, subcontractors, agents, brokers and other service providers.
This is a process which includes establishing the risk appetite for an organization which is the level of risk that the organization is prepared to accept in pursuit of its objectives, and before action is deemed necessary to reduce the risk. It represents a balance between the potential benefits of innovation and the threats that change inevitably brings.
It is important for owner’s planning to exit a business as they look to optimize their value and be a low a risk investment decision for a prospective purchaser. As a purchaser begins to complete a due diligence process to understand the real value of each business they are considering purchasing, along with all of the standard reports they would expect to be provided; They are also provided executive summaries and detailed reports about the risk exposure of the entire third-party population. This will demonstrate to the purchaser:
- The company has a disciplined, risk-based process for working with their third parties to ensure ongoing oversight and risk mitigation activities are in place, and
- Includes effective contract management, optimal cost management, regulatory compliance, data privacy, cyber protections, performance metrics and ongoing third-party oversight
This demonstrates an investment in innovation and oversight which are the underpinnings of a well-run organization. If all other factors are close or equal, this could be a differentiator to get optimal value for a company and secure a successful exit.
It is as equally important for owner’s considering purchasing a business as they are looking to achieve an optimal purchase price with confidence of the future revenue, growth and stability of the business. It is almost a mirror image of what was just outlined above for those selling a company. Imagine if the prospective seller was able to provide the purchaser with executive summaries and detailed reports about the risk exposure of their entire third-party population. This will demonstrate that they are a well-run business you can have confidence in as they have made a solid investment to ensure there are no surprises coming from their third-party partners.
To learn more about what is included in a third-party risk management program please reference our recent article on the topic.
So, whether you are considering buying or selling a business think about the importance of mitigating the risk with your third-party vendors and how it will impact the value of your company and the successful exit or purchase you are planning to make.
