Game On: Can Gamification Help Engage Suppliers in Third-Party Risk Management

The complexity of supply chain risks facing organisations today means that third-party risk management (TPRM) has never been more important. But for suppliers, the process of completing lengthy risk management assessments is often tedious and time-consuming. In this article, we explore the opportunity to introduce elements of gamification into TPRM to increase supplier engagement and enthusiasm – while ensuring that the process is as effective and rigorous as it needs to be. 

Third-party risk management (TPRM) can be a repetitive and tedious process, particularly for the suppliers that have to complete multiple lengthy risk assessment questionnaires for different clients. Making this arduous process more engaging and enjoyable for suppliers should be a focus for improving TPRM outcomes. Indulge us for a thought experiment.
‍

Having fun makes work easier 

Gamification refers to the use of game design elements and game principles in non-game contexts – such as websites, apps, online communities, education tools and many other platforms. The aim is to engage and entertain consumers, employees or other stakeholders, and to inspire collaboration and interaction. Some of the most commonly used gaming elements include points or reward schemes, badges to show achievements, or leaderboards to add a competitive element. 

Gamification has been widely and successfully used by many organisations in recent years. Learning apps use achievement badges, streaks and scoreboards to motivate learners. Retail, food and hospitality brands use reward programmes to track purchases and reward loyalty with special offers or free products. Fitness trackers use targets, rewards and challenges to help users reach their goals. 
‍

Applying gamification to third-party risk management 

Given the growing threat of cyber-attacks in today’s digital supply chains, organisations need all the help they can get to engage third-party suppliers in risk management and cyber security initiatives. So how could the principles of gamification be used to better engage suppliers in TPRM?

There are various ways in which risk assessment processes can be adapted into game-like scenarios. While adding gamification to the process should create a sense of fun and excitement, it must not add to the time or resources required to complete these tasks. 

Here are some suggestions for game elements that organisations could introduce seamlessly into their supplier risk assessments:

Security score leaderboard

Organisations could rank suppliers based on their security scores. Suppliers would earn points for factors such as the completeness of their risk assessment questionnaires, the timeliness of their responses, or improvements made to their security posture. This helps to add a competitive incentive to the risk management process, encouraging suppliers to improve their position on the leaderboard, especially if a leaderboard such as this would be accessible to potential future clients, demonstrating to them how serious the supplier takes its security, and hence potentially opening up new business opportunities.

Achievement badges

Similarly, suppliers could be rewarded with digital badges for reaching specific milestones, such as consistently completing assessments promptly, for achieving high security scores in different security domains, or for delivering consistent enhancements to their security measures. These badges could be displayed on supplier profiles on a risk management platform to showcase achievements and help suppliers win new business. 

Reward scheme

Leaderboards or achievement badges could be augmented by reward or incentive schemes. Suppliers could gain ‘preferred supplier’ status for consistently high performance in risk management. They could work towards this ‘preferred’ or ‘gold’ status, which would unlock benefits such as exclusive access to networking events or priority consideration for new contracts. Monthly winners could be announced, with the reward of a donation to a chosen charity or local project as an incentive. 

Progress mapping

Organisations could create visual security journeys on which suppliers could track their progress in enhancing their security. The journey could be illustrated on a map or pathway, with milestones along the route for suppliers to achieve. These milestones could include completion of initial risk assessments, implementing specific security controls, or achieving recognised industry certifications. Suppliers would be able to see their progress along the security journey, helping to motivate them to reach the next goal and deliver continuous improvements. 

Learning quests

Improving the security posture of suppliers often requires educating key internal stakeholders and staff about cyber security tools, processes and practices. Taking a cue from popular educational apps, organisations could introduce educational ‘quests’ into TPRM for suppliers’ team members to complete to aid this educational journey. Completing each learning quest could unlock points, which allow suppliers to declare higher levels of security expertise. The learning quests could include interactive tutorials on best practice in cyber security, scenario-based problem-solving exercises, and mini-courses on emerging security threats. 
‍

Stay in the game: Overcoming objections 

It’s important that any game elements introduced into the risk management process do not trivialise the importance of TPRM. Leaderboards, badges or learning elements must fit naturally into the process, without adding to the workload or commitments of suppliers. There need to be clear benefits of engaging in the gaming elements for suppliers, such as the rewards and incentives mentioned above. 

There is likely to be scepticism and resistance to gamification from some suppliers. This can be addressed by educating suppliers about the importance of engaging people fully in effective risk management for the benefit not just of their business, but for all supply chain members. 

It’s important to adapt any gamification strategies to different types of supplier and the different risks they face. Real-world TPRM challenges will need to be built into the game features, to demonstrate the relevance of these activities to the risks in the current cybersecurity landscape. This is where new developments in analytics and machine learning can help to customise game elements for different users.

‍

What’s new in gamification?

As new technologies develop and are applied to gamification, there will be new opportunities to enhance the game elements of risk management to encourage even greater engagement. 

As in so many areas of life and work, AI (artificial intelligence) is enhancing the way we experience gamification. By analysing usage patterns, AI can personalise game elements such as rewards and challenges to suit individual preferences. It can also adjust difficulty levels to ensure all participants are appropriately challenged and engaged. 

Immersive technologies such as virtual, augmented and mixed reality offer the chance to transform game playing. They enable digital data and game elements to be overlaid on real-world scenarios, creating more interactive, absorbing and distraction-free experiences. 

Blockchain technology might offer the potential in the future to create transparent, gamified TPRM processes that ensure data is kept secure and confidential. Integrating blockchain into gamified TPRM platforms could help to improve trust and efficiency among supply chain participants, while ensuring compliance in an ever-changing regulatory landscape.  

‍

Finding novel ways to improve risk management 

At a time when digital supply chains present risks that are increasingly difficult to identify and monitor, it’s never been more important for organisations to engage suppliers in truly effective risk management.

Introducing gamification could play a key role in transforming often tedious risk assessment processes for suppliers. Incorporating more interactive, competitive and rewarding experiences into the process not only helps to engage people in completing risk assessments more thoroughly, but can also motivate suppliers to continue focusing on improving their security processes and practices over time. 

Any strategies that help to reinforce and improve the effectiveness of TPRM are especially important today, as organisations face a constantly evolving roster of new risks brought about by rapid technological change. 

Look out for future articles from Risk Ledger on how to advance third-party risk management to protect your organisation and its supply chain partners.