Contracts Hold the Key to Proactive Risk Management

1. Contracts Hold the Key to Proactive Risk Management Have you ever noticed what any of us do when we have to cross the road at a busy intersection? We look to the left and to the right, even before we take the first step. If there’s a traffic light, we wait for it to turn red before stepping off the curb and onto the street. In essence, what we are actually doing all this while is calculating risk. And if you think about it, we are always calculating and looking out for risk in the smallest steps we take (like crossing the road) to the largest decisions we make, like signing a contract with a new customer or supplier. For enterprises, risk often originates from contracts, either as a result of a third-party’s failure to comply with contracted terms or due to a misalignment between contracted terms and the regulatory environment the business is operating in. This is more than evident from the fall of Carillion a few years ago. But are organizations truly well positioned to preempt and mitigate potential contracts risks before they negatively impact the bottom line? The Disconnect Between Contracting and Risk Management Surprisingly, knowledge of contract risk is limited among enterprises. This can be attributed to the fact that companies have largely relied on manual processes or point solutions and siloed risk management processes in their effort to mitigate risk. In this regard, conventional

2. governance, risk and compliance (GRC) tools are widely used to analyze and report on risk. While they are not ineffective, GRC tools alone cannot connect third-party risk insights from across business processes and link them back to contracts. As a result, they are only able to offer a largely retrospective fragmented view of third-party risk. More importantly, businesses often struggle to gain visibility into their own contracts, which limits their ability to monitor obligations to regulators, suppliers, and customers. Contracts are largely where all these obligations, service levels and other KPIs are embedded, and without the right set of tools to surface them on demand, businesses potentially expose themselves to substantial risk. In addition, enterprises do not have the necessary contract intelligence in place to manage upstream risk during the contract drafting and negotiation process itself. In its present state, contracting is largely manual. Drafts are authored using non-standardized templates and legalese that could be out of date and misaligned with current company and regulatory policies. During the negotiation process, legal review teams could also end up overlooking major clause deviations or missing clauses, which could have catastrophic downstream consequences, which will be difficult to trace back to an originating contract. The bottom line is that when risk management operates as a siloed function that cannot connect contracts to risk at the enterprise level, it will remain ineffective. Rooting Risk Management in Smarter Contract Management The first imperative is to recognize that risk assessment and mitigation measures need to be built into every transactional process across the enterprise, starting with contracting. Since contracts define with whom a company is doing businesses and subsequently, the terms of the deal, they can be treated as a single source of truth for identifying third-party risk.

3. The first goal then is to set up a Contract Lifecycle Management platform that can seamlessly integrate with an existing GRC system to pull in counterparty risk data to ensure that contracts can only be created with pre-vetted third parties who have already qualified all onboarding and compliance criteria. If a counterparty is blacklisted on the GRC tool, this information will be cascaded down to the CLM platform to ensure a new contract cannot be created for this specific entity. The next step would need to focus on solving the visibility problem so that stakeholders across the enterprise have a holistic view of all past and present contracts. This can be achieved by leveraging best-in-class AI-led digitization and contract analytics capabilities of flagship CLM platforms such as SirionOne. The goal is to integrate such a CLM platform with the enterprise tech stack – typically comprising ERP, CRM, and P2P systems – and automatically pull in, extract, and centralize all contracts and associated documents stored in these data silos. In doing so, the entire enterprise contract portfolio becomes immediately accessible and amenable to downstream analytics required for contract risk management. At this point, the CLM platform should be able to mine the entire corpus of contracts to enable risk discovery by identifying missing clauses, clause deviations, and similar risk elements. These insights, in combination with AI-led negotiation and contract amendment capabilities, can be leveraged to address identified risk areas, which may have otherwise gone undiscovered. Once the CLM process has been digitally transformed in this manner, enterprises can work towards establishing a standardized contracting playbook containing preapproved clauses and templates, which can be used to further standardize and de- risk the contracting process. If you’d like to learn more about how SirionOne and its category-leading AI capabilities can help you in building efficient contract risk management practices, please reach out to us at here. We’d love to hear from you!