Article 1 of 3 – Rethinking Third-Party Risk Management: Technology, Governance and Business Resilience 

Why Third-Party Risk Management Remains So Challenging 

Organisations are devoting more time, effort and resources to Third-Party Risk Management (TPRM). Dedicated TPRM functions have emerged, regulatory expectations have increased and organisations have access to more third-party data than ever before. Yet many still struggle to build programmes that are effective, scalable and capable of responding to an increasingly dynamic risk landscape. 

The underlying issue is not a lack of awareness or activity. It is that the nature of third-party risk has evolved faster than many of the programmes designed to manage it. 

From compliance obligation to business resilience 

Historically, TPRM was viewed largely as a compliance activity. The focus was on meeting regulatory obligations through supplier onboarding checks, sanctions screening, anti-bribery controls and periodic due diligence. These remain important, but they now form only part of a much broader picture. 

Today’s organisations depend on third parties to deliver products, run technology, process data, operate critical business functions and access new markets. As that dependency has increased, so has the range of potential exposure. Operational disruption, cyber incidents, concentration risk, financial failure, human rights concerns and reputational issues can all arise through relationships that sit outside the organisation’s direct control.  

A cloud provider may hold critical data and run processes on which the organisation depends. An outsourced service provider may perform a regulated or business-critical function. An agent or intermediary may represent the organisation in a high-risk market. A manufacturer may rely on subcontractors several tiers upstream that are invisible to the buying organisation. Distributors, logistics providers, joint venture partners, consultants and contingent workers can each create different forms of exposure. 

The risk also rarely stops with the contracting entity. Ownership structures, subcontracting arrangements, shared infrastructure and wider supply-chain dependencies can all create fourth-party exposure. Geopolitical events, sanctions changes, export controls and regional conflicts can alter that exposure more quickly than annual or biannual review cycles were designed to accommodate. 

We now see boards asking different questions. They want to know not only whether regulatory requirements have been met, but where the organisation is operationally exposed, how resilient its supply chain is, how quickly emerging issues can be identified and who is accountable for responding to them.  

TPRM is therefore no longer simply about satisfying regulatory requirements; it has become a strategic capability that supports business resilience and better-informed decision-making. 

Different relationships require different responses 

The widening range of third-party relationships creates a practical challenge: there is no single set of checks that is appropriate for every third party. 

An agent engaged to win business in a foreign market may require a strong focus on anti-bribery and corruption risk, ownership and political connections. A cloud provider processing personal or commercially sensitive data requires scrutiny of cyber security, data protection, resilience and subcontracting. An outsourced provider performing a critical function may require concentration analysis, service-continuity planning and clear exit arrangements. A supplier within a physical supply chain may require greater attention to labour practices, sourcing, environmental claims and upstream visibility. 

Effective TPRM therefore starts with understanding the nature of the relationship and the risks it creates. That should determine the depth of due diligence, the specialists involved, the approval route and the intensity of ongoing monitoring. 

This sounds straightforward, but many programmes still apply a broadly standard onboarding process and then add specialist reviews in parallel. The result can be a long questionnaire, duplicated requests and multiple assessments that do not necessarily combine into a clear view of the third party’s overall risk. 

Fragmented ownership creates a fragmented view 

This is partly an organisational problem. Responsibility for third-party risk is usually distributed across several functions. Procurement may own onboarding, Compliance may manage financial crime and integrity checks, Legal may oversee contractual protections, Cyber Security and Data Protection may conduct technical assessments, and ESG or Sustainability teams may review environmental and human rights concerns. 

Each function brings necessary expertise. The difficulty arises when these activities operate as separate processes rather than as parts of a connected third-party lifecycle. 

Fragmentation can lead to duplicated assessments, conflicting risk ratings, inconsistent escalation and poor visibility of the organisation’s total exposure. The business may be asked for the same information several times, while no single owner has a complete view of the relationship. In some cases, the complexity and delay encourage business teams to bypass controls altogether. 

Many organisations have invested heavily in individual tools and assessments but have not yet resolved the underlying questions of governance: who owns the overall relationship, how risk domains should be combined, what constitutes a material issue and who has authority to accept, remediate or exit the risk. 

From more data to better decisions 

The challenge is compounded by the volume of information now available. Organisations can draw on sanctions and watchlist screening, adverse media, financial health indicators, cyber ratings, ESG data, supplier questionnaires, corporate records and a growing range of digital intelligence sources. 

This greater visibility is valuable, but more information does not automatically lead to better risk management. Risk teams can become overwhelmed by alerts, false positives, inconsistent scoring and data that lacks sufficient context. Significant issues may be difficult to distinguish from background noise, while the ownership of escalation and remediation remains unclear. A mature programme is not defined simply by how many third parties it screens or how many sources it consults. It is defined by whether it identifies the risks that matter, directs them to the right people and supports timely, proportionate action. 

Achieving that requires more than adding a dashboard. Organisations need a shared understanding of materiality, clear risk appetite and prioritisation rules, and feedback on whether previous decisions proved effective. These are governance and operating-model questions as much as data or technology questions. 

Technology as an enabler, not the starting point 

Technology, automation and artificial intelligence have an increasingly important role to play. They can help organisations gather information at scale, connect data from different sources, identify changes in risk profiles, reduce repetitive work and direct attention towards higher-priority issues. 

However, technology alone cannot decide which risks matter to a particular organisation, resolve fragmented accountability or determine the appropriate business response. A tool configured around unclear requirements is likely to automate existing weaknesses rather than remove them. 

The starting point should therefore be the decisions the organisation needs to make across the third-party lifecycle. From there, it can determine which processes should be standardised, which data is genuinely useful, where automation can improve speed and consistency, and where specialist or human judgement remains essential. 

This is also why effective TPRM increasingly requires advisory, implementation and technology capabilities to work together. Governance, risk segmentation, operating-model design and escalation processes need to be aligned with the technology used to collect, prioritise and monitor third-party information. Neither element is sufficient in isolation. 

Looking ahead 

The most effective TPRM programmes are not necessarily those with the most assessments, data sources or technology. They are those that apply proportionate controls, create a coherent view across risk domains and convert emerging information into timely decisions. 

For those managing large or complex third-party populations, technology will be increasingly important in achieving the necessary scale and responsiveness. However, before investing in technology, organisations must be clear about the risks they are managing, the decisions they need to support and who is accountable for taking action. 

In the next article in this series, we will explore the evolving TPRM technology landscape, the different capabilities available and the questions organisations should ask to distinguish genuine value from vendor claims. 

Co-authored by Craig Fitzpatrick, Forensics Partner PwC, and Michael Harris FCMI PAGRC, Head of Regulatory Affairs, Neotas.  

Articles in this Series:

• Article 1 of 3 – Why Third-Party Risk Management Remains So Challenging
• Article 2 of 3 – Technology Is Transforming TPRM – But It’s Not a Silver Bullet
• Article 3 of 3 – Building an Effective Third-Party Risk Management Operating Model