News Archive

Students, Professionals Gather at the Muma College of Business To Take a Third-Party Risk Management Certification Course

By Keith Morelli

TAMPA (Feb. 16, 2017) -- About 75 people, many University of South Florida students, are attending a three-day, third-party risk management certification course held in the Muma College of Business, learning how to protect clients who use other companies to perform some regular business functions.

Third parties, also known as suppliers or vendors, now are commonplace in the business community because they can provide services at a lower cost; they are more convenience and offer higher flexibility.

But these business arrangements have some inherent risks. Some third parties don't have adequate controls and protections and the businesses that hire them can be exposed to fiscal, operational, regulatory and reputational risk.

"If you outsource a service, you, as the owner of the company still own that risk," said Dawn Treffeisen, senior manager of ICG Third Party Controls and ICG Cross Border Data Privacy at Citi, in introducing the curriculum Tuesday afternoon. "You never outsource the risks or the responsibilities."

Data breaches of third party systems are becoming more frequent and can be costly for a business, their customers and employees, she said, citing recent cyber attacks at Yahoo and Target, in which personal information of customers was lifted from internal records.

People remember Target and Yahoo and the reputations of those companies suffered, but those breaches were to systems of a third party, she said, and no one remembers the names of those services.

Third-party risk assessment will be the next career boom for business graduates, she predicted. This course, co-sponsored by Citi and USF, is the inaugural certification course offered by the financial giant and the university, she said.

"Yeah, it's been a year in the making," she said, pointing to a thick packet of information and pointing out a handful of experts in the field who flew from around the country to Tampa just to present topics during the course.

"This is a tremendous opportunity for our students to get a head start in what certainly will be a growing need in the real business world in the very near future," said Kaushal Chari, associate dean for research and professional programs at USF's Muma College of Business. "Our students attending the course are working side by side with seasoned professionals with Citi to better understand the complex issues of third-party risk management.

"We are aware that more and more businesses and corporations are outsourcing some of their basic business functions and determining who those contractors are is incredibly important," he said. "Students who take this course and graduate with this certification will find themselves more than ready to enter this new niche in the business job market."

More than 41 percent of surveyed companies sustained a data breach through a third party, according to a survey by the Ponemon Institute, and the consequent loss of brand value typically ranged from $184 million to more than $330 million.

The risk management course teaches professionals and students how to identify elements that make a third-party arrangement safe. The course began Tuesday and ends Thursday. Participants must pass an assessment exam to receive the certification.

Among the topics: how to assess the risk of a third party, the bidding and contracting process and evaluating third-party financials. Additional subjects to be touched on: how to manage a third party relationship and how to manage risk and controls.

More and more businesses and corporations are outsourcing functions such as payroll and accounts receivable, Treffeisen said. Cyberattacks and data breaches – or other problems – are part of the risks that come with third-party services, which are somewhat out of the hands of business owners and managers.

And such events cannot only cost money, but they can put employees and customers at risk and damage a company's reputation. And it's that threat that makes third-party risk managers an emerging profession. Industry observers expect an 86 percent increase in demand for risk managers over the next several years.

"It's a good career choice," Treffeisen said.