No company is an island. Organi­zations are a complex and diverse system of processes and business relationships. Risk and compliance chal­lenges do not stop at traditional organiza­tional boundaries. Organizations struggle to identify, manage, and govern extended business relationships. The challenge is: “Can you attest that risk and compliance are managed across extended business relationships?” An organization can face reputation and economic disaster by es­tablishing or maintaining the wrong busi­ness relationships, or by allowing good business relationships to sour because of weak oversight.

Organizations tend to look at the for­mation of a business relationship and fail to foresee that issues cascade and cause se­vere damage to reputation, and exposure to legal and operational risk throughout the ongoing relationship. They make two common mistakes: