Insights – Third Party Risk Management

Conversations Around Where Third-Party Risk Starts to Break in Practice

Expert discussions, podcast conversations, operational observations, and research focused on third-party risk, operational resilience, supplier dependency, and governance.

Watch the key clips

Short on time? Get the highlights from this episodes in minutes.

Meet Arina Razmyslovich

Most third-party risk programmes are built around structured assessments, security ratings, and documented controls.

But what if some of the most valuable risk indicators sit outside those traditional sources?

In an upcoming episode of the Extended Supply Chain Conversations Podcast, I sat down with Arina Razmyslovich from DN Institute to discuss public signals in Third-Party Risk Management and how organisations can identify early warning signs before they become incidents.

The conversation explores operational signals, workforce indicators, organisational stress, and why some risks become visible long before they appear in formal assessments.

A fascinating discussion and one that challenged several assumptions we have about vendor monitoring.

More to come soon.

Intro to Public Signals in TPRM

What if we’re measuring the wrong things in TPRM?

Most organisations have access to security ratings, assessment results, control evidence, and monitoring platforms.

Yet major third-party incidents still catch firms by surprise.

One of the more interesting observations from my recent discussion with Arina Razmyslovich was that many warning signs are often publicly visible long before a breach occurs.

The challenge isn’t always data availability.

It’s knowing where to look and recognising which signals matter. That raises an uncomfortable question.

If the warning signs were already visible, why didn’t we act on them?

We’ll explore that in more detail in the upcoming episode.

Importance of Public Signals in TPRM

A vendor can maintain excellent security ratings and still be heading towards operational failure.

That’s one of the strongest takeaways from my recent conversation with Arina Razmyslovich.

Employee reviews describing security team burnout. Discussions about slow incident response. Operational complaints appearing across public forums.

The signals can be visible, documented, and freely available months before a major incident occurs.

The question isn’t whether the information exists. The question is whether our current TPRM models are designed to see it. Perhaps the biggest challenge isn’t a lack of data. Perhaps it’s that we’re still measuring the wrong things.

Full discussion coming soon.

Meet Elizabeth Dunsmoor

One of the recurring themes in third-party risk is that some of the biggest disruptions don’t originate inside the vendor relationship itself.

In an upcoming episode of the Extended Supply Chain Conversations Podcast, I sat down with Elizabeth to discuss geopolitical risk, supply chain exposure, and why organisations are increasingly being affected by events that sit far outside traditional TPRM frameworks.

From sanctions and trade restrictions to data residency and geopolitical instability, we explored how external events can quickly create operational consequences for critical services.

A fascinating discussion and one that challenges how many organisations should be thinking about resilience.

More to come soon.

The Blind Spot

A vendor appears as “low risk” in the register. Controls were reviewed. Due diligence was completed. Risk rating was approved.

Then, sanctions hit the region they operate in. Nothing changed about the vendor. But your service was disrupted overnight. And here is where that blind spot sits.

Most TPRM frameworks are designed to assess vendors. Far fewer are designed to assess the environment around them.

And increasingly, that’s where some of the biggest risks are emerging. Unfortunately, the IRQ approach that you hold so close to your heart, isn’t reflecting the real world. And the real world – as discussed in the podcast – is #armed, #dangerous and doesn’t care about your #SLAs.

We’ll be exploring this in an upcoming discussion on geopolitical risk and operational resilience.

The World Doesn't Care About Your Vendor Register

The real world doesn’t care how your vendor inventory is organised.

A political decision made thousands of miles away can impact a critical service overnight. A trade restriction can disrupt a supplier dependency.

A change in data sovereignty rules can alter where information can legally be stored.

None of these events start with the vendor. Yet they can still become your problem.

One of the strongest themes from my recent discussion with Elizabeth was that resilience increasingly depends on understanding the broader ecosystem around suppliers, not just the suppliers themselves.

Full conversation coming soon.

The Resilience Question

Most organisations can identify their critical vendors.

The harder question is understanding what happens when the environment around those vendors changes unexpectedly.

A) Jurisdictions. B) Supply chain dependencies. C) Concentration risk. D) Data residency. E) Geopolitical exposure.

These factors rarely appear neatly inside a risk register, yet they increasingly influence operational resilience.

A question we explored during a recent podcast discussion: If a geopolitical event affected one of your critical vendors tomorrow, could you identify which services would be impacted within the first hour?

That’s where resilience starts to become very real. Full discussion coming soon.

Agentic AI - The Rise of Autonomous Systems in TPRM

Agentic Al in TPRM – At #3am, your #TPRMteam is #asleep. (if not, we have bigger problems) Your agentic Al is reviewing vendor risk scores -> correlating signals -> flagging anomalies and -> preparing your CRO’s morning briefing.

By the time you arrive, it has already found what you would have spent the day looking for.

You’re #stillincharge. The #watching is just no longer your problem.

Natural Language Generation (NLG) in TPRM

NLG: Natural Language Generation (NLG) pulls the signal from the noise and writes the narrative for you. Concise. Prioritised. In language a CFO or board member actually understands.

Using Associated Domain Risk Indicators (ADRIs) in TPRM

ADRIS – Most TPRM dashboards still treat inherent risk domains like separate Netflix series.

Your inherent risk model tells you what’s “Critical”; ADRIS on the other hand: Associated Domain Risk Indicators – tell you who else should be dragged into the assessment when one domain gets flagged as red.

In this episode I unpack ADRIs as a practical DORA – aligned technique for correlation across ICT, InfoSec, data, AML and conduct – and why ignoring them is exactly how incidents end up hitting three domains at once.

Overreliance on Algorithms

We all love a smart dashboard, but at what point does “AI‑driven vendor risk” quietly turn into blind trust in a model we don’t fully understand?

In this clip, Rolf, Olga and I unpack the danger of overreliance on algorithms in TPRM – and what breaks when humans stop asking questions.

Balancing Speed with Human Judgement in Use of AI

AI can process vendor data faster than any team… but speed isn’t the same as judgement. In this segment, Olga talks about where automation really helps in supply chain assurance – and where a human still needs to own the decision, especially when it affects real people and real money.

Data Sets in AI

AI shines when it has oceans of historical data. It’s a lot less impressive when you take it somewhere genuinely new. This teaser dives into thoughts from Rolf on why most models are great at pattern‑matching yesterday’s problems – and why that matters when you’re exploring new vendors, new markets, or new types of risk.

Generative AI in TPRM

GenAI is already writing assessments, summarising contracts, and suggesting risk scores. Useful? Yes. A silver bullet? Definitely not. In this podcast clip with Rolf and Olga, we discuss where GenAI adds real value in TPRM – and where its limitations (hallucinations, context gaps, governance) mean you still need a strong human in the loop.

Alert Fatigue from Continuous Monitoring

Continuous monitoring” sounds great in the slide deck… right up until your team is drowning in alerts. In our recent podcast with Olga and Rolf – we talk about the reality of AI‑driven monitoring across global supply chains: signal vs noise, analyst fatigue, and how to design controls that don’t keep everyone awake 24/7.

Closing Thoughts

We ended this episode where every serious AI conversation eventually lands: governance. In the wrap- up for this podcast, Rolf and Olga bring it back to basics – clear accountability, strong oversight, and keeping humans firmly in the loop so AI supports TPRM decisions rather than quietly making them for us.

TPRM in Healthcare

#TPRM in #Heathcare

Published on 10 September 2026, the report from the UK’s National Commission into the Regulation of AI in Healthcare delivers a clear message: AI assurance must be Proportionate, Lifecycle-based, and System-wide.
In Healthcare AI, the Risk is never just the Algorithm. It is the a) operating environment, b) model updates, c) upstream dependencies, and d) contractual controls around it.
In this video we unpack what #healthcareleaders and #TPRM teams need to ask before deploying AI in critical workflows.
Drop us a DM if you want to discuss building practical lifecycle governance into your AI supply chain.

AI in Third-Party Cyber Risk Assessments

Throwback to a conversation with Olga Tymofeieva on use of AI in Third-Party Cyber Risk Assessments:

We were already asking a question that feels even more relevant now: How much decision-making are we actually prepared to hand over to AI?
TPRM has moved quickly from spreadsheets, to dashboards, to models that can summarise assessments, spot anomalies, and increasingly recommend what practitioners should do next. That speed across all stages in TPRM lifecycle is immensely useful.

But faster, is not automatically better. And automation is not the same thing as Assurance. When an AI-supported assessment gets a supplier risk decision wrong, the model doesn’t own the outcome – We do.

The focus around AI in TPRM has never been whether we can automate more. Of course we can.

It’s deciding where automation should stop and experienced human judgement absolutely needs to take over.

A short throwback to my conversation with Olga on the benefits + limits of using AI responsibly in Third-Party Cyber Risk Assessments. Head over to Insights – Third Party Risk Management to get access to the full podcast.
#ThirdPartyRisk #TPRM #ArtificialIntelligence in #TPCRA #OperationalResilience #VendorRisk