Understanding How Third-Party Risk Management Affects Reputation Risk--and Why It's Important
By Branan Cooper
December 3, 2018
Branan Cooper is Chief Risk Officer with Venminder, Elizabethtown, Ky., a third-party risk management solutions firm. He has more than 25 years of experience in the financial services industry with a focus on management of internal processes and controls, most notably in the area of third-party risk and operational compliance.
Reputation risk is one of the factors of risk that is easy to understand but tough to quantify. The Federal Financial Institutions Examination Council states, "Reputation risk occurs when negative publicity regarding an institution's business practices leads to a loss of revenue or litigation."
Third-party relationships that result in dissatisfied customers, interactions not consistent with your company policies, inappropriate recommendations, security breaches resulting in the disclosure of customer information and violations of law and regulation are all examples that could harm a company's reputation. Also, any negative publicity involving the third party, whether or not the publicity is related to your mortgage company's use of the third party, could result in reputation risk.
As Wells Fargo and Equifax have learned over the past year or so, you can have a sterling reputation based on years of established history, only to have it get annihilated by a single incident such as a data breach. In the case of Wells Fargo and Equifax, their flat-footed response in terms of time and degree of concern shown for the impact to customers have led to ongoing concerns about their management's capacity to understand the breadth of the problem.
When entering into a new third-party relationship, it's incredibly important to truly understand with whom you're doing business. As part of your Bank Secrecy Act/Anti-Money Laundering practices, you're likely checking their ownership structure and doing an Office of Foreign Assets Control check; however, you should go even further and look at how the consumers or other businesses view the products/services being provided. Essentially, you're on the lookout for consumer complaints. In today's internet age, that can be a very easy task with the following resources:
--A quick Google news search, which may produce headlines that you need to further investigate
--The Better Business Bureau searchable database
--The Consumer Financial Protection Bureau/Bureau of Consumer Financial Protection searchable database
--RipOffReport and Consumer Reports
If you find they have a significantly poor reputation, you may want to re-think even doing business with them. If you disregard this and you decide to move forward, be sure to understand their complaint management strategies and/or require them to refer all complaints about your products/services to your company.
How to Mitigate Risk Before It Happens
It's important to know which of your vendors pose a reputation risk to your mortgage company. Here's a helpful hint--they all do! With that being said, take these items into consideration to dig even further and help prevent an impact on your company's reputation.
5 Tips for Managing Vendor Reputation Risk
1. Always consider how a vendor's actions can affect your overall reputation. Consider both third and fourth parties.
2. Understand which of your vendor's have access to sensitive customer information (e.g. shred company, attorneys).
3. Set up alerts so that you receive negative news monitoring notifications. This can be as simple as a Google news alert.
4. Plan and establish a response strategy. You need to be prepared should something happen to one of your critical vendors and they are in the news. Chances are your customers will come to you with questions.
5. Document. Thorough analysis is always important in third party risk management as a whole. Be sure to document the ongoing monitoring that you plan to conduct in order to help prevent an impact on your company's reputation risk.
Even in Shakespeare's Othello, we hear a well-known line, "Reputation, reputation, I have lost my reputation." The issue isn't new. Fortunately, modern tools are available to detect and respond to issues in a more efficient manner as they arise.
Reputation risk is every bit as important as other categories of risk but sometimes the risk is much tougher to quantify and predict. With the right monitoring and procedures in place, you will have the tools to combat the risk as much as possible.
(Views expressed in this article do not necessarily reflect policy of the Mortgage Bankers Association, nor do they connote an MBA endorsement of a specific company, product or service. MBA Insights welcomes your submissions. Inquiries can be sent to Mike Sorohan, editor, at email@example.com; or Michael Tucker, editorial manager, at firstname.lastname@example.org.)