Solution
“Whistic allows us to take a more fine-grained approach to the security review process,” said Chet. “Now, depending on their results, we may just do a remote assessment and not send someone on-site, so we realize large savings from not doing unnecessary evaluations.”
“We still have the same number of vendors with high inherent risk, but getting the scoring through Whistic, we’re able to carve out suppliers who don’t require the on-site follow-up procedure,” said Chet. This is why the detailed evaluation is so vital to Marlette Funding. It provides greater insights into a vendor’s control environment. They also utilize Whistic’s patented CrowdConfidence™ scoring algorithm as part of their evaluation process.
On-site follow-up activities cost nearly $30k each, so eliminating unnecessary visits is essential. The analysis possible with Whistic allows them to accurately distinguish which follow-up method is the most appropriate. In addition to cost savings, the time to onboard a new vendor is greatly reduced.
On the other end of the spectrum are suppliers who provide service, but only one department uses them. “In the past, we would have done nothing with them. But now, since we have a smaller inventory of high-risk vendors, we can do more and evaluate these suppliers,” said Chet. “We may send them a SIG assessment through Whistic, for example, so we’re able to do more due diligence with our low-risk suppliers than we were previously.”
“By using Whistic, we have a truer picture of what the residual risk is from our suppliers,” said Chet.
This is true for both high and low-risk vendors. “We’ve reduced expense on the highs, and there’s not a monetary amount associated with it, but we now have a clearer view of our low-risk vendors,” said Chet.
Evaluating low-risk suppliers is essential as well, because, even in circumstances where no PII is ever exposed, there’s still a reputational risk if any information is breached.