How to manage third-party risk in the public sector

How does third-party risk affect the public sector?

While all organizations experience some level of exposure to third party risks, the unique operating environment of the public sector — with ever-growing levels of stakeholder expectations and external scrutiny — creates conditions where failing to plan appropriately for these third-party risks has unique consequences, including:

Delay in essential services

A failure to address third-party risk exposes your organization not only to financial loss but could also interrupt services that support community well-being, including healthcare, food services, infrastructure maintenance, and more.

Reputational damage

A delay in services isn’t the only consequence if a third party fails to perform to the standards public servants and stakeholders expect — it also damages the public’s trust in the government and can also have political consequences.

How to limit third-party risk in the public sector

Your organization must take steps to mitigate third-party risks to protect against delays in essential service and reputational damage. While it is not possible to fully eliminate third-party risks, ensuring that the appropriate measures, contracts, and oversight are in place can reduce or minimize third-party risks and maintain transparency and accountability in the public sector.

Consider the following best practices:

Follow applicable directives

Governments operating at the municipal, provincial, and national level are subject to directives that guide all decisions when contracting with third parties. These directives are intended to ensure accountability and transparency throughout the process.

For example, the Directive of Management Procurement directs how third-party assets are procured to support the delivery of services to Canadians. The directive includes guidelines around risk management and procurement decisions to achieve operational outcomes.

Your organization might also be subject to additional regional directives. For example, the Transfer Payment Operational Policy in Ontario applies to departments at the provincial and municipal level. It sets the operational requirements and accountability framework for transfer payments to external recipients, including third parties contracted to deliver services.

Set expectations

It is essential to set clear expectations when your organization contracts a third party to deliver services in the public sector. Determine key performance indicators (KPIs) such as strategic, operational, and performance goals and identify the desired outcomes of the contract before entering an agreement with a third party.

Ensure the right oversight

After the expectations for the third party are determined, your organization should ensure it has the appropriate structures in place to oversee the delivery of the outsourced services.

Monitor and report on results on a regular basis to track performance and ensure the third party is meeting objectives. You can choose to either renew, update, or terminate the contract after it expires based on whether the third party was able to achieve the desired outcomes.

Have a backup plan

Consider contracting multiple vendors to supply the same services. These backups are essential to prevent a delay in services and minimize reputational damage if one vendor does not meet expectations and is released from their contract.

Follow the third-party risk management lifecycle

Keep the third-party risk management lifecycle in mind when outsourcing services to a third party. The third-party risk management lifecycle can be tailored to address the specific risks faced by public sector organizations and includes:

• Identification and due diligence — Identify and assess the third party to determine the criticality and level of risk exposure posed by the potential relationship.
• Contracting and onboarding — Establish the parameters for the relationship’s success. Both parties will agree on the risks to be managed and how they will be distributed, the terms for data ownership and transfer (if any), the scope of services to be delivered and delivery methods, Service Level Agreements, penalties for non-performance, and subcontracting rules among many others.
• Performance monitoring — Monitor third parties by tracking agreed upon service levels and the supporting KPIs to ensure service delivery meets or surpasses expectations.
• Evaluation and offboarding / renewal — Consider the cost, regulatory changes, quality of services, and overall relationship with the third party to determine if the contract will be renewed, updated, or terminated.

Read Understanding third-party risk management for more information about the third-party risk management lifecycle.

Take the next steps

As the post-COVID landscape continues to grow and change, organizations in both the private and public sector are becoming increasingly more reliant on third parties. While third parties can support modernization efforts and the implementation of new systems, they also pose specific risks to organizations in the public sector.

Public sector leaders should be mindful of the risks of contracting with third parties and the consequences if those risks aren’t properly managed. An advisor can help you set up a third-party risk management framework to protect your organization and better manage risk exposures created by third parties.

Contact an MNP Enterprise Risk advisor for more information if you need help setting up a third-party risk management framework. Our advisors will work with you to identify and address the threats across all areas of your organization.