Find Resources & Connect with members on topics that interest you.

AI - Acquire and Implement

PO - Plan and Organize

DS - Deliver and Support

Please sign in to see your topics.

You must be logged in to join this group.

DS2.2 - Supplier Relationship Management

This topic is intended to enable collaboration and sharing of information to facilitate a better understanding and approach to implementing this COBIT control objective based on the risk, value and guidance provided by its corresponding control practices.

COBIT Control Objective DS2.2 - Supplier Relationship Management is contained within Process Popup Manage Third-party Services.

Learn more about COBIT and related publications.

Click “Join This Community” to be able to actively participate in discussions and contribute content. You must be an ISACA member to join this topic. Join ISACA now.

 
This Topic Has:
3 Members
0 Online
776 Visits

 Recent Discussions

Community Leader

Knowledge Center Manager

Knowledge Center Manager

Title: Become a Topic Leader!

Points: 3


Supplier Relationship Management

Formalise the supplier relationship management process for each supplier. The relationship owners should liaise on customer and supplier issues and ensure the quality of the relationship based on trust and transparency (e.g., through SLAs).

View value and Risk Drivers  help

Hide value and Risk Drivers help


Value Drivers

  • Relationships promoted that support the overall enterprise objectives (both business and IT)
  • Effective and efficient communication and problem resolution
  • Clear ownership of responsibiltiies between customer and supplier
  Risk Drivers
  • Supplier not responsive or committed to the relationship
  • Problems and issues not resolved
  • Inadequate service quality

View Control Practices  help

Hide Control Practices  help

  1. Define and formalise roles and responsibilities for each service supplier.
  2. Assign relationship owners for all suppliers and make them accountable for the quality of service(s) provided.
  3. Document the supplier relationship managers and communicate the information within the organisation.
  4. Establish and document a formal communication process between the organisation and the service provider.
  5. Ensure that contracts with key service suppliers provide for a review of supplier internal controls by management or independent third parties.
  6. Regularly review the reports between the organisation and the service supplier.
  7. Register incidents caused by suppliers and report them using the company’s internal incident management process.
  8. Periodically review and assess supplier performance against established and agreed-upon service levels. Clearly communicate suggested changes to the service supplier.

 

Discussions: 0 total

Must be a Topic member to contribute

No Results Found

Documents & Publications: 34 total

Events & Online Learning: 0 total

No Results Found

Journal Articles: 160 total

Volume 2, 2012
by Gan Subramaniam, CISA, CISM, CCNA, CCSA, CIA, CISSP, ISO 27001 LA, SSCP
What should be the recovery strategy that I must impose on the vendor to ensure an effective recovery of the services, if a crisis were to ever occur?
Volume 1, 2012
by Prakhar Srivastava and Tarun Verma
Log management can play a pivotal role in addressing PCI DSS requirements, be a success factor and enabler for safeguarding cardholder transaction data, and provide a secure and vulnerability-free environment for cardholders.
Volume 6, 2011
by Harmeet Kaur, CEH
As today’s business climate demands greater efficiency, security and regulatory compliance, the need for an effective IAM process has never been more pressing.
Volume 5, 2011
by Joseph Kirkpatrick
Security by abdication is when a company decides that rather than accept the responsibility of securing and maintaining systems, people or processes, it will abdicate the responsibility by moving to the cloud.
Volume 5, 2011
by Derek Mohammed, Ph.D., CISA, CISSP, PMP
Organizations need fully articulated security policies and procedures based on industry best practices to solidify their information system defenses and meet legal, contractual and regulatory requirements.
Volume 3, 2011
by William C. Brown, CISA, CPA, and Byron J. Pike, CPA
The US Securities and Exchange Commission (SEC) is planning what could be among the largest changes in the history of American accounting.

Wikis: 2 total

Blog Posts: 4 total

Must be a Topic member to view blog posts
7 Mar 2012
To share various espects in cloud computing viz; history, availability, deployment, integrity, availability, confidentiality, security, cloud sharing etc.
Posted By : MoizB583519 | 2 comments
On March 1st,  I was invited to speak at the CampIT conference on Enterprise Risk/Security Management at Rosemont Convention Center. Before me there were two speakers. The first presenter spent an hour presenting the story from the trenches of technolog...
Posted By : Umesh391 | 0 comments
In the UK? Report UK bank internet phishing scams! Are you getting lots of fake internet phishing scam e-mails. I've been reporting and forwarding mine to the UK bank safe group; http://www.banksafeonline.org.uk/report_­scam.html­ This site was setup...
Posted By : PLim | 0 comments
8 Jun 2010
Hello, this is my first post on my blog at ISACA.  I feel honored to be among the many members of the ISACA organization and look forward to exchanging ideas, issues, and changes in the Information Security and all of the areas of Risk, Governance, and Co...
Posted By : Donald515 | 0 comments