Third-Party Relationship Warning Signs

Third‐Party Relationships and Warning Signs

A third-party relationship depends on the supplier’s competence, ability and willingness to do the contracted job. Many organisations use a supplier selection process and due diligence to ensure they are working with someone qualified to provide a product or service and do this reliably. Further, organisations will usually negotiate a service level agreement (SLA) that will specify what needs to be done (e.g. the supply of IT services) and the information to be provided (e.g. performance statistics on relevant systems and networks) so that everything should work smoothly.9

Over and above this, you might see regular catch‐up discussions with third parties to discuss how things are going and to address any issues, concerns or questions.

Most of the time, things will go well, but despite the desire to keep things ‘on track’, here are some of the things that can go wrong with third parties that I have seen result in unpleasant surprises:

• People stop paying attention. If you engage a third party, there is often a flurry of activity to get things up and running: project meetings, transition teams, etc. Then, hopefully, things run smoothly, and the excitement that was there at first starts to dissipate. Managers may have reasonable grounds to believe that the third party is doing as good a job, perhaps an even better job than was being done before.

Then someone takes over the lead role for managing the contract, has a busy diary and asks, ‘Why am I meeting them again?’ and at some point, unless something terrible is happening, attention can turn in another direction. Then sometime later, things may go wrong, and the organisation realises, ‘No one was managing the contract properly from our side’. In other words, just because there is a contract in place and potential penalties may arise if things go wrong, that does not mean that everything will run smoothly with a third party.

Ian Brimicombe (SVP, Specialist Finance, and Projects, Burberry) stresses the importance of properly attending to third‐party relationships:

‘We work with a wide range of third parties and regard it as central to our business model to have a laser‐like focus on not only what they do for us but also how they operate. As a result, we demand high standards from our suppliers across a range of dimensions and recognise the need to monitor product quality, environmental impact and employment standards frequently.

Equally, we are always open to feedback from suppliers and contractors regarding process improvements to meet or exceed required standards. If you see regular improvements in operations, that's a good sign the supplier is treating the standards seriously. If things stagnate, this can be a warning sign that suppliers are not paying sufficient attention to the detailed requirements.’

• Third‐party responses may depend on who they are dealing with.

You might see some or all of the following ‘influencing strategies’ from third parties:

• Those who put a ‘positive spin’ when it comes to presentations for senior executives (highlighting good news stories that happened and proposing new things they can do next year).
• Organising client ‘networking sessions’ and conferences, where their customers meet one another and hear about recent achievements and potential future developments, which can provide new ideas but may also have an element of ‘feeding egos’.
• Corporate entertainment.

None of these third‐party influencing strategies necessarily cause problems. But these ‘best foot forward’ activities by third parties can sometimes buy them the benefit of the doubt if there are problems. Damian Finio observes:

‘You need to recognise, when you are dealing with senior people, that part of the skill they have is their charisma and ability to impress. They can explain things in a credible way. They can answer questions truthfully, but without necessarily telling you everything you might want to know.

It's something you need to look out for as you gain more experience, the little details that get masked. And this isn't always about them deliberately hiding things; it's about them knowing how to highlight the best of what they have done and have explanations for things that have gone wrong.

For that reason, showcase events are not always the best way to understand what's happening “on the coal face”. This is where digging into data, not just the averages, but specifics, can be so valuable. Likewise, pay attention to whether explanations for problems seem to explain symptoms or root causes.’

• Exercising audit rights and paying attention to ‘weak signals’.

If a third party is performing a critical role (e.g. IT services, call handling, payroll, etc.), managers might put arrangements in place to audit aspects of what they are doing. For example, how the third party handles data and information (e.g. so it stays secure) and accounts for revenue or costs (e.g. so any fees paid are correct). The results from these audits can give managers assurance they wouldn't get from a standard performance report, a catch‐up meeting or even visiting their facilities. However, it's essential to be clear about the scope and depth of any audit work done to understand the level of assurance given and in which areas. Good practice I have seen to ‘head off’ issues can include:

1. Expecting to see in‐depth updates on the progress being made to address any previous areas of concern.
2. Getting copies of other audit reports concerning the activities of the third party, to get more confidence in what is being done.
3. Commissioning audits on specific topics of particular importance to probe, for example, information security, the integrity of non‐financial information and other important information that might reveal important business or reputational risks (e.g. the quality of call handling and complaint resolution, beyond numerical metrics).

And a simple, low‐cost way of getting ‘signals’ that things may not be going as you would like is to ask operational staff how easy they find the third party to deal with on day‐to‐day matters. You'd be surprised how often delays on little issues at an operational level can be an early warning signal that your organisation is no longer its highest priority.