Vendor Risk Management Using COBIT 5

Abstract

The pressure is on in many organizations to find ways to holistically evaluate and control risks in the supply chain. Companies need to evaluate when and if risks are introduced, measure those risks, develop strategies to manage them, and continuously monitor them. This article explores new guidance that offers a COBIT-aligned approach to vendor management and, by extension, management of risk in a practical and effective way.

Notes

1. http://www.weforum.org/docs/WEF_SCT_RRN_NewModelsAddressingSupplyChainTransportRisk_IndustryAgenda_2012.pdf

2. http://online.wsj.com/news/articles/SB10001424052702304450904579367391844060778

3. http://sdm.mit.edu/news/news_articles/kyratzoglou-supply-chain-risk-management/kyratzoglou-supply-chain-risk-management.html

4. http://www.isaca.org/Knowledge-Center/Research/ResearchDeliverables/Pages/Vendor-Management-Using-COBIT5.aspx

5. http://hitrustalliance.net

6. https://sharedassessments.org

7. https://cloudsecurityalliance.org/research/grc-stack

8. http://www.information-age.com/industry/services/123457824/70-cios-will-change-their-technology-and-sourcing-relationships-next-two-three-years-gartner

Additional information

Notes on contributors

Robert Stroud

Robert Stroud, CGEIT, CRISC, is vice president of strategy and innovation at CA Technologies. He is also a member of ISACA’s Professional Influence and Advocacy Committee and will be installed as the association’s next international president in June.