Jonathan PrewittThe postings on this site are my own and do not necessarily represent FTI Consulting’s positions, strategies or opinions.
Welcome back to the wild, unpredictable world of Third-Party Risk Management! We’ve waded through the swamps of vendor vetting, survived the delusions of contractual security, and now we’ve arrived at the moment we all secretly dread: the vendor-fueled fire. Yes, today we’re tackling the fine art of incident response—otherwise known as “How to Pretend Everything Is Fine While the World Burns Around You.”
When Disaster Strikes: The Vendor Firestorm
Picture this: It’s a peaceful Tuesday morning. You’re sipping your overpriced, artisanally brewed coffee, maybe even daydreaming about the weekend, when suddenly—BAM! You get the call. Your vendor has just had a colossal meltdown. Maybe it’s a data breach that’s making headlines faster than you can say “reputation damage,” or a critical system failure that’s threatening to turn your company into a case study in disaster management.
The first rule of incident response? Don’t panic. Or at least, don’t look like you’re panicking. Sure, your heart rate just doubled and you’re sweating through your shirt, but on the outside? Calm. Collected. Totally in control—just like a swan, gracefully gliding on the surface while paddling like mad underneath. It’s showtime, folks.
Step One: Assess the Situation (Or, What the Heck Just Happened?)
Before you start running around like a headless chicken, take a moment to figure out what exactly has gone wrong. What kind of mess are you dealing with? Is this a minor glitch, or is your vendor about to take you down with them in a blaze of incompetence? Gather as much information as you can, as quickly as you can, and try to resist the urge to bang your head against the nearest wall.
And don’t forget, you’ve got to get the real story from your vendor. This is where that “open communication” you’ve been fostering comes into play—or, if you’re less fortunate, where you realize your vendor has been ghosting you like a bad Tinder date. Brace yourself for excuses, half-truths, and enough corporate jargon to make your eyes glaze over.
Step Two: Activate Your Incident Response Plan (You Have One, Right?)
Assuming you were proactive enough to create an incident response plan—because who doesn’t love planning for worst-case scenarios?—now’s the time to put it into action. If you don’t have a plan, well, congratulations! You’re about to learn why winging it is a terrible idea.
Your incident response plan should be a step-by-step guide to dealing with disasters. It’s like a fire drill, but with more spreadsheets and fewer opportunities to escape the building. Gather your incident response team, divvy up tasks, and start working through the plan like your job depends on it—because, let’s be honest, it probably does.
Step Three: Communicate, Communicate, Communicate (Without Causing a Stampede)
When everything’s going wrong, the last thing you want is a communication breakdown. Your team needs to know what’s happening, what the plan is, and—most importantly—that you’re not about to jump ship. Externally, you’ve got to manage the delicate balance of transparency without sparking a full-on panic.
Think of yourself as a magician, artfully revealing just enough to keep the audience (your stakeholders) calm while hiding the chaos behind the curtain. You want to be seen as the hero, not the person who let the tent catch fire in the first place.
Step Four: Contain and Mitigate the Damage (Aka, Stop the Bleeding)
Once you’ve got your communication strategy down, it’s time to roll up your sleeves and deal with the actual problem. Containment is your first priority—whether that means isolating a compromised system, shutting down operations temporarily, or physically restraining the vendor’s CEO from making things worse (kidding… mostly).
Mitigation is where you try to ensure this doesn’t happen again, at least not in the same catastrophic way. It’s like putting out a grease fire in the kitchen and then swearing off fried food forever—except you know you’ll be back at it next week, because, well, some lessons never stick.
Step Five: Learn and Adapt (Or, How to Avoid Doing This Again)
After the flames have been doused and the dust has settled, it’s time for the post-mortem. What went wrong? How did you get into this mess in the first place? And more importantly, how can you avoid it happening again? This is where you gather your team, and maybe even your vendor (assuming they’re still in business), to dissect the disaster in all its gory detail.
Take this opportunity to tweak your incident response plan, tighten your vendor management practices, and, if necessary, reconsider your life choices. The goal is to come out stronger—or at least less likely to get burned next time.
The Calm After the Storm (Or, Faking It Until You Make It)
Handling a vendor-related crisis isn’t exactly anyone’s idea of fun, but with the right approach, you can emerge from the chaos looking like a pro. The key is to stay calm, be prepared, and, most importantly, make it look like you’ve got everything under control—even if you’re secretly wondering how it all went so horribly wrong.
In my next post, I’ll dig into “Third-Party Audits: How to Uncover the Skeletons in Your Vendor’s Closet,” where we’ll explore the joys of auditing your vendors and discovering all the things they didn’t want you to know.
Until then, keep that crisis management kit handy, and remember: in the world of TPRM, you’re only as good as your last disaster.
See you in the next act!
Jonathan Prewitt