Third Party Management Case Study: Metro Credit Union
The Challenge: Outgrowing Manual Third-Party Management Processes
Developing a technology strategy around third-party management from a blank piece of paper might sound unmanageable for most financial institutions. But for Metro Credit Union—the largest state-chartered credit union in Massachusetts—approaching technology as a grassroots effort contributed to their tremendous growth. Acquiring this known recognition required tackling some hurdles first, such as conquering vendor monitoring challenges; establishing greater integration with their risk management subsets; and eliminating spreadsheets.
1. Vendor Monitoring
Metro Credit union lacked a centralized tool or platform to analyze all of its vendor relationships. As a result, it was difficult to understand how the existing vendor relationships impacted the credit union. A complete upfront inventory meant:
- Understanding their vendor ecosystem (i.e. who they were doing business with and what types of relationships they had with others);
- Properly risk rating each vendor relationship with an appropriate and consistent scoring methodology (from a contractual standpoint); and
- Monitoring these vendors (which ultimately became a significant time challenge).
2. Integration
Integration was a key selection criterion in choosing WolfPAC over other leading stand-alone tools. The need for full integration with other risk management subsets—and having all the data flow into their board reporting—removed any silo possibilities. The benefit from the integrated platform highlighted one solution as their system of record as it pertained to third parties and risk management.
3. Spreadsheets
Metro knew that using spreadsheets as an internal risk management tool wasn’t scalable. Vendor management became more complex as they grew. This created an essential need to completely outsource their third-party management solution to both WolfPAC and Maple Street.
Metro needed to embrace a responsive framework for its third-party relationships—one that would accelerate its growth by deploying technology internally and externally, and by facilitating service to its members through offered products and services.
The Solution: A Next-Gen Third-Party Management Solution
WolfPAC Integrated Risk Management gave Metro the key data insights they needed. Using the WolfPAC modules allowed them to see how third parties and technologies were intertwined, and how those relationships impacted their daily processes. Previously, this information flow was handled as discrete workflows within their own silos. This process didn’t allow for an overall view of essential data. Unfortunately, it also led to pertinent information getting lost in the shuffle.
Through its partnership with WolfPAC and Maple Street, Metro has increased its productivity and efficiencies by moving its third-party management initiatives into a web-based environment. What used to be considered an intensive, time-consuming effort that required an extensive process to reach out to all vendors is now a comprehensive, streamlined effort. As the additional experienced efficiencies are in scale, a dedicated vendor staff is no longer required because the tool grows with the company. Adding unlimited vendors, unlimited technologies, and modifying the operating procedures as the tool grows with them has become an easy task.
When Metro needed greater vendor monitoring internally, Maple Street filled that role. Maple Street became responsible for the execution of the inventory and the risk management component, conducting risk assessments and determining the needed monitoring frequency.
With all the collected data on each vendor resulting in an effective vendor rating, the question now evolved into how to decipher that information. With hundreds of vendor relationships from a payable standpoint, it became necessary to break down the most critical vendors and those that provided services. Managing hundreds of vendors in-house became unwieldy for a dedicated Metro Credit Union resource to manage, so WolfPAC’s Third-Party Risk Management provided the needed infrastructure solution through contracts management and self-monitoring.
Results
Both WolfPAC and Maple Street simplified the process for Metro Credit Union by consolidating critical vendor documents that are now shared in the industry. Metro’s own productivity increased by 50%, as all their third-party documents are now consolidated in a vendor package with a completed analysis. Performing a management review on that vendor package, which is viewed in a portal, saves Metro countless hours and prevents starting from scratch to chase individual documents.
Metro’s main task has become more strategic, as opposed to tactical, in ensuring that the two systems are accurate and reflect one another. For example, every identified contracted vendor in the WolfPAC platform corresponds to a Maple Street contracted vendor record contract. This results in the two services complementing each other with the full risk assessment—specifically, the risk management capabilities of the WolfPAC system coupled with the vendor management services from Maple Street. Now in its second year of working with Maple Street, Metro envisions expanding on some of Maple Street’s services, such as vendor performance statistics work, cost expense reduction, and aligning the vendors with parameters of the contract.
Customer Feedback:
“Metro’s chosen third-party solution approach has made us feel safe and kept our members safe. Going back to the threat-based risk assessments and our ability to easily see where our threats are as an organization, how those threats map to our relationships, and what controls we have in place to mitigate those ensures we feel safe with all the key modules,” said Traci Michel, SVP of Operations.
“If a gap exists, we can see it very easily in the color-coded charts, and then I know, based on the criticality, where we should spend the time, money, and resources to remediate. Without that in-depth view bringing it all together, you are either going based on gut, grasping at straws, or you’re spending hours and hours trying to parse spreadsheets to get there. It definitely cuts down the analysis time significantly and gives us a good feeling that we have the right controls in place.”
Another benefit of this partnership is that regulators have annually acknowledged Metro’s strong foundation with WolfPAC. Having WolfPAC previously implemented before going through their vendor management project, Traci has heard many times from their consultants that: “they are in a better place than most clients going through this because they have inventoried technologies, inventoried our third parties, you know where your data flow and risks are, and we were able to export that. If we did not have WolfPAC in place prior, we would have again done an immense amount of foundational work just to get ourselves prepared.”
Conclusion:
We’re glad the regulators are happy, but we’re happier knowing Metro Credit Union feels WolfPAC Integrated Risk Management “keeps members safe and keeps the organization safe.”