Vendor Risk Management: From Start to Finish in 12 Weeks with MetricStream GRC Cloud

The Client: Zurich Insurance Company Ltd (UK)

Overview

In 2013, the UK sourcing team of Zurich Insurance was given a tough mandate - find and implement a Vendor Risk Management (VRM) solution across 500+ vendors in just three months! It was a tight deadline - yet, the urgency was warranted, as there were multiple vendor related challenges that had to be addressed quickly. VRM processes had become increasingly complex, manual, and labor intensive. In the absence of an effective VRM system, most critical vendor information was managed on spreadsheets.

Adding to the challenge, the sourcing team had developed a “toolkit” of vendor policies and procedures, which hadn’t been uniformly adopted across the organization’s sourcing and procurement functions. 

The sourcing team began looking for a VRM solution that could be quickly implemented out-of-the-box, without any customization. The solution needed to be scalable with end-to-end functionalities for VRM, as well as self-service tools that would enable vendors to upload data on their own. 

The implementation timelines were challenging, and the demands were tough. Yet the sourcing team was determined to make it work.

Solution

How Technology Has Helped

The MetricStream VRM Solution has simplified and strengthened VRM processes across Zurich Insurance’s UK operations. The solution was rolled out over MetricStream GRC Cloud, and as a result, it went live within a few weeks, despite the large scale and scope of the implementation. 

Today, the solution is enabling and supporting the following processes at Zurich Insurance:

• Vendor and contract information management- All vendor related data is consolidated in a single database, making it easy to track any vendor in any location. In addition, all vendor documents, including templates, business continuity plans, and exit plans are maintained centrally for easy search and reference.
• Due diligence- When a new vendor has to be selected, the solution streamlines the entire due diligence lifecycle.
• Information security risk assessments - At the click of a button, the solution provides complete visibility into the security assessments across all vendors, so that Zurich Insurance can respond in a timely manner.
• Assurance testing - The solution enables a risk-based approach to vendor assurance testing. At any time, users can check which vendors have good or bad assurance and performance scores. They can also track vendor KPIs and SLAs, and make sourcing decisions accordingly.
• Issue management - If any vendor risk issues arise, the solution helps investigate and resolve them before they spiral out of control.
• Workflow automation - Every day, users can view their VRM schedule, and identify outstanding tasks, upcoming tasks, and high-priority tasks. Sourcing executives also have a better view of their team’s schedules.

Challenges

Benefits

• Better control over vendor risks
  All vendor governance information and risk data are consolidated in a central location. Therefore, users have the visibility to quickly identify risk issues, and resolve them in a timely manner.
• Simplified vendor governance
  The solution automates vendor governance processes, thereby saving time, effort, and resources. It also helps in efficiently planning and scheduling various vendor governance tasks and assignments.
• Greater scalability
  The MetricStream solution is scalable – it can be extended beyond the UK sourcing team, and used across Zurich Insurance to achieve a greater level of consistency in VRM processes.
• 20% reduction in FTE
  Within just 12 weeks, the MetricStream solution helped Zurich Insurance realize 20% efficiency savings in VRM.