The Third Party Risk Institute Podcast

Regulations, ESG & Cyber Risk: What’s Changing in Third Party Risk Management for 2025

Share episode

In this episode of The Third Party Risk Institute Podcast, we dive into the major shifts in regulatory expectations, ESG obligations, and cybersecurity threats that are reshaping Third Party Risk Management (TPRM) in 2025.

From the tightening grip of global regulators to the growing complexity of ESG due diligence and the rise of AI risks this episode offers a comprehensive look at what risk leaders need to prepare for now.

What we cover in this episode:

  • How DORA, FINRA, and new U.S. privacy laws are raising the bar on third-party oversight
  • Why ESG is no longer optional and what it means for your vendors and contracts
  • The impact of AI and emerging tech on data privacy, due diligence, and risk scoring
  • Which new expectations are hitting procurement, compliance, and cybersecurity teams hardest
  • How to future-proof your TPRM program through governance, automation, and centralized tools

You’ll walk away with practical insights on:

  • Mapping vendor risk across global regulations
  • Setting up effective ESG and privacy controls
  • Embedding real-time cyber monitoring and AI oversight
  • Building a resilient TPRM function that meets 2025’s complexity head-on

This episode is ideal for:

  • Risk and Compliance Leaders
  • Procurement & Sourcing Professionals
  • ESG, Audit, and Privacy Officers
  • Cybersecurity and GRC Teams
  • Third Party Risk Analysts & Program Owners

Want more?
Explore our training programs, assessments, and resources designed for professionals advancing their third-party risk capabilities at Third Party Risk Institute Ltd.

🎧 Enjoying the podcast?
Explore more resources, expert insights, and certification programs at www.thirdpartyriskinstitute.com

📱 Follow us on LinkedIn for real-world conversations and industry trends: Third Party Risk Institute Ltd.

📬 Have a question or topic you'd like us to cover?
Email us at: info@thirdpartyriskinstitute.com

Welcome to the deep dive. Today we're diving deep into a topic that's really changed. It's moved from, you know, a niche concern to something absolutely core for every organization. We're talking third party risk management or TPRM, specifically looking ahead to 2025. You might still think of it as mostly an IT thing, but well, the sources we looked at paint a very different picture.

They really do.

Yeah. 2025 is shaping up to be pivotal. We're seeing regulations tightening up globally quite significantly. And alongside that, this huge surge in ESG demands environmental, social, governance. The reality is businesses rely so much now on this whole complex web of vendors, partners, cloud providers for critical stuff.

And what's truly compelling or maybe concerning is that this reliance just inherently expands your uh digital footprint, your attack surface. It brings in all these new vulnerabilities.

So, not just cyber threats.

No, not just cyber anymore. We're talking potential service outages, big reputational hits, you name it. The old way of thinking about TPRM kind of siloed that's dissolving fast. It's now very clearly an enterprisewide thing. It demands real collaboration and integrated approach across the whole business.

So it's not just a few updated rules we need to track. This sounds like a fundamental shift in how businesses have to operate, how they manage risk. Our mission today is to well cut through that complexity, highlight the really critical challenges you need to be aware of and then hopefully review some actionable strategies, ways you can turn the shifts into, you know, not just compliance headaches, but maybe sustainable growth, real competitive advantage.

That's the goal.

Okay, let's unpack this.

So, our sources really hammer this home. Continuous monitoring, it's not optional anymore. It's basically standard practice.

Oh, absolutely. Standard.

and it covers so much ground. Cyber operational risk, reputation, ESG, financial stability, all of it. That's the key thing to grasp. The implication is that a failure in just one of those areas, let's say a cyber breach at one of your third parties, it doesn't stay contained. It can easily trigger this cascade effect right across your business. Suddenly, your operations are impacted, your reputation takes a nose dive.

and it might even expose problems you didn't know you had, like uh maybe ESG compliance gaps, data privacy issues.

Exactly. Things like data privacy, maybe even worker conditions depending on the breach. This deep interconnectedness, it just demands a holistic approach, an integrated TPRM framework, one that can actually identify, assess, and and you know mitigate all these tangled up risks effectively.

which sounds like it needs different departments talking to each other more.

Oh absolutely robust cross-functional collaboration is essential and centralized risk reporting. You need that unified comprehensive view of risk not just inside your walls but across the whole extended enterprise all your partners vendors that's really vital if you want to build genuine organizational resilience moving from just reacting to well being proactively prepared.

right okay here's where it gets really interesting I think the regulatory piece. Let's dive into that evolving landscape for 2025 first because it really seems like a landmark year. Lots of new laws, stricter enforcement pretty much everywhere. And first up, financial services. They seem to be right under the microscope.

more than ever. FINRA, the financial industry regulatory authority in the US, they've significantly elevated TPRM. They actually dedicated a whole new category just to third-party risk in their 2025 annual regulatory oversight report. That's not a small change.

No, that sends a pretty clear signal.

It really underscores the critical and frankly growing risks coming from these vendor relationships, especially cyber security and service outages. Those are top of mind. The report reinforces existing obligations too under Fenera rules around supervision, business continuity, customer data protection. But the really critical new piece, this mandate for timely notification, we're talking within 72 hours if a soda's provider has an incident.

72 hours. That's fast.

It is. And it's not just about reporting faster. It fundamentally shifts the burden. Before maybe firms had a bit more time to investigate internally. Now you have to have immediate integrated response plans already worked out with your vendors. Incident response becomes this real time shared responsibility, not just cleaning up after the fact.

Wow. Okay. So, beyond that 72-hour rule, which is huge, what are the other practical takeaways? What should financial institutions be doing like right now based on Fener's guidance?

Well, Fener points out common areas where firms have stumbled and it gives a pretty clear road map.

  • First, strengthen your vendor oversight. That means comprehensive TPRM policies. Simple enough on paper, harder in practice.
  • Second, enhance incident response planning specifically by involving your third party vendors in your cyber drills and tests. Don't just test your internal team.

Makes sense. Test the whole chain.

Exactly.

  • Third, you have to actively address fourth party risks. Assess if your vendors are using subcontractors and make sure your contracts cover that layer, too.
  • and critically adapt to new risks. Specifically, evaluating how your vendors are using generative AI.

Uh AI again.

Yes. Adjusting contracts to say prohibit unauthorized data ingestion into open source AI models. Reviewing any AI tools they use for things like recordkeeping or supervision compliance. So proactively, financial institutions really need to be reviewing and updating vendor contracts now. Focus on cyber data protection termination clauses. Implement stronger due diligence with regular security and operational reliability checks, enhance internal training, and crucially maintain a centralized inventory, know who all your third party and fourth party relationships are. You can't monitor risk if you don't know who you're dealing with.

Okay, that's fra in the US. But you mentioned this is global. What about Europe? Are we seeing similar trends?

We are. Broader supervisory expectations are definitely emerging across Europe. The big one is the EU's digital operational resilience act, DORA, that applies from January 17, 2025. It's critical. It mandates rigorous vendor risk assessments. Requires comprehensive exit strategies for critical services.

Exit strategies. Okay. Planning for when things go wrong or relationships end.

Precisely. And audits of critical ICT services for financial institutions. It's all pushing for that proactive stance, not just reactive. We're also seeing the European Banking Authority, the EBA, revising its outsourcing guidelines to line up with DORA. And ESMA, the Securities Regulator, published principles on third party risk supervision, too.

So, Europe's moving towards harmonization, it sounds like.

Yes. These European initiatives taken together, they signal a clear drive towards much more unified, proactive standards for digital operational resilience, especially in finance. They want to ensure businesses can basically withstand major tech disruptions no matter where they start in the supply chain. And this really contrasts quite sharply actually with the US data privacy landscape. There, fragmentation is much more the name of the game.

How so?

Well, companies operating international or even just across multiple US states, they face this kind of dual challenge. They need to understand these harmonized frameworks like in the EU. But at the same time, they need agile compliance programs to handle all the different sometimes conflicting US state requirements. It often forces them to adopt a kind of most stringent approach and technology becomes key just to keep track.

That contrast really does highlight the global tightroppe businesses are walking, doesn't it?

It does.

And it sounds like regulator everywhere are demanding more proof. Not just policies, but demonstrating robust continuous oversight, scenario testing, having predefined contingency plans ready to go, it's about proving resilience proactively, not just saying you have it. That really shifts the compliance burden, makes it much more active.

Absolutely. And you know, while the FDICU reported that what was it? 98% of institutions they supervised had satisfactory consumer compliance programs back in 2023.

Pretty good number.

Seems good, right? But then the Consumer Financial Protection Bureau, the CFPB, hit several major players with significant enforcement actions in late 2024 and early 2025. We're talking Equifax, Block, Inc., the Cash App folks, and banks involved with the zel network.

And what was the common issue?

The common thread was often failures in safeguarding consumer information or preventing fraud that involved third party networks. So, it shows even with generally good overall ratings, these large-scale failures linked to third parties. They still result in significant penalties and major reputational damage.

2025, it seems like a big year for new state laws kicking in.

It is a significant expansion and it creates this really complex sort of patchwork quilt of regulations that directly impacts how you handle data through third parties.

What are some key requirements popping up?

Well, a big one is mandates for universal opt-out mechanisms. Things like the Global Privacy Control signal for data sales or targeted advertising or sometimes both. We're seeing this in states like Delaware, Maryland, Minnesota, Nebraska, New Hampshire, New Jersey, Tennessee, often with deadlines hitting in 2025 or 2026.

And that means businesses have to make sure their partners honor those signals, too.

Exactly. Your third-party ad tech vendor, your data processor, they need to respect that user preference passed along from your site. It requires technical integration and contractual agreements. Delaware's law The DPDPA even explicitly says you have to disclose who the third party recipients of data are if someone makes an access request. Adds another layer of transparency needed.

Okay. What else?

We're also seeing data protection assessments becoming mandatory. These are basically risk assessments for any high-risk data processing activities.

including those involving third parties.

Yes, explicitly including those involving third parties. States like Delaware, Maryland, Minnesota, Nebraska, Tennessee are requiring these. And Maryland's law moda gets Even more specific, it requires risk assessment specifically for AI and machine learning systems that impact privacy.

Interesting. Targeting AI directly.

And then you have Nebraska and Tennessee mandating opt-in consent for processing sensitive data, which is a higher bar than opt out.

Wow. So the sheer number and I guess the variety of these state laws.

it sounds like contracts become absolutely critical.

Critical. You need robust vendor contracts that clearly spell out data handling responsibilities. You need strict processes for honoring opt outs across your partners and you need continuous monitoring of their privacy practices. Honestly, organizations really have to look at security and compliance platforms now. Tools that centralize these third party risk assessments and monitoring trying to do this manually across what 15 20 different state laws, it's just not feasible at scale.

Yeah, you can see why. And it's really striking how AI keeps coming up. Regulators are clearly keyed into the new risks on viner talking generative AI Maryland requiring AI risk assessments. How is AI transforming this TPRM space? Is it more of a tool or more of a risk itself?

It's absolutely both. A complex challenge and a powerful opportunity on the opportunity side. AI offers incredible capabilities, automating risk assessments, enhancing them by processing vast amounts of data, improving incident response. We're seeing large language models, LLM, being used right now to quickly scan vendor documents and questionnaires, find inconsistencies. That saves analysts a ton of time.

So, it's being adopted.

Oh, yeah. Our sources show nearly half of organizations surveyed are already using AI in their CRM programs. Another third are actively piloting solutions and its use correlates with higher program maturity and better business outcomes.

Okay. But the challenge side.

the challenge is that successful AI use needs really robust data security, strong governance, and transparency. And as we said, regulators like Fanner are already scrutinizing how vendors use GenAI. They're requiring contract changes to stop vendors from feeding your data into open-source AI models without permission.

Right. So, your vendor using AI could create a risk for you.

Precisely. While AI can boost your security and risk management, its uncontrolled use by your third parties can create entirely new vulnerabilities. Data leakage, bias, lack of explanability. So, organizations need this sophisticated kind of two-pronged AI strategy. You need to leverage AI for your own risk management. Yes, but you also have to meticulously govern and audit how your vendors use AI, especially with sensitive data. This means explicit contract clauses about AI use and ongoing monitoring specifically for AI related risks in your supply chain.

It's complex. Just to give folks a concrete feel for this US state patchwork, give me a couple of quick examples.

Sure. Take the Delaware Personal Data Privacy Act, TPDPA, effective January 1st, 2025. It mandates universal opt out eventually by 2026, requires those third party disclosures we mentioned, and mandates data protection assessments for high-risk stuff.

Okay, Delaware. What about another state?

Contrast that with say the Iowa Consumer Data Protection Act, ICDPA, also effective January 1st, 2025. It requires opt out, but only for data sales, not for targeted advertising. See the difference?

Subtle, but important.

Very. Then you have the Maryland Online Data Privacy Act, MODPA, effective October 1st, 2025. It includes a ban on certain ads to minors and specifically requires those AI accountability risk assessments we talked about along with universal optout.

So, the variations are significant. What's the takeaway for businesses?

The takeaway is you need immediate actionable insights. Your contracts need different clauses depending on the state laws applicable to your vendors and customers. Your due diligence questions need to adapt. Your monitoring has to track compliance against multiple different standards. You just can't have one single blanket approach anymore.

Got it. Okay, let's shift gears now. Let's talk ESG, environmental social governance. You said earlier and our sources confirm in 2025 this has definitely moved beyond you know voluntary CSR report. is becoming mandatory, regulated, part of DPRM. What's really driving this seismic shift?

It's really a confluence of factors. Evolving regulations are a huge part, especially out of Europe. But there's also mounting pressure from investors, from communities, customers, and I think a growing recognition finally that sustainability and ethical practices, they aren't just nice to haves, they are fundamental to long-term business resilience.

And the European rules are really pushing the supply chain aspect.

Oh, absolutely. European directives are particularly driving supply chain due diligence like we've never seen before. The sheer volume and the specificity of new EU regulations explicitly target due diligence for human rights risks, environmental impacts, forced labor, right down the supply chain. Corporate accountability doesn't stop at your own front door anymore. It extends across the entire value chain. That includes your subcontractors and even your supplier suppliers, those fourth parties again.

Wow. So that requires a whole new level of visibility.

It necessitates robust supply chain mapping. Really understanding who is in chain, continuous due diligence, not just one-off check, on all tiers of suppliers, and strong contracts that mandate ESG adherence right from the start.

So, if you had to boil it down, what's the single most profound shift companies need to grasp about ESG and their supply chains in 2025? Is it just more paperwork or is it deeper?

It's fundamentally about accountability and proactive transparency. It's moving way beyond a check the box exercise. Take the Corporate Sustainability Due Directive, CSDD. The EU adopted it in 2024. It mandates large companies identify, prevent, mitigate, and account for adverse human rights and environmental impacts, not just in their own operations, but across their chains of activities that explicitly includes business partners.

Even with potential changes focusing more on tier one.

even with recent talk about possibly limiting some obligations primarily to direct suppliers unless risks are suspected further down, the core message is still crystal clear. Integrate due diligence into your policies. monitor if it's working and communicate about it publicly.

Okay. CSDD. What are some other key EU examples?

Well, there's the EU deforestation regulation, EUDR, that's set to apply from December 30, 2025. It basically bans key commodities, cattle, cocoa, coffee, palm oil, rubber, soya, wood, and products made from them from the EU market unless they meet three criteria. They have to be deforestation free, produced legally according to the source count's laws, and covered by a due diligence statement. Companies have to submit this statement provide geolocation data for the origin. Keep records for 5 years. It demands serious traceability. Then you have the EU batteries regulation, EU BTR. Strict due diligence on human and labor rights risks throughout the battery value chain, especially sorting from conflict zones. The enforcement date for verification got pushed to 2027, but companies need to be ready way before that. And finally, the EU forced labor regulation, EU FLR, just entered into force December 2024. It prohibits products made even partly with forced labor from being sold in or exported from the EU. Member states have until late 2025 to set up authorities and the full obligations kick in late 2027.

That's a whirlwind of legislation. It really paints a picture of how fast the goalposts are moving on ESG, particularly from Europe. So beyond just, you know, doing good or meeting these new rules, how do these ESG factors connect back to a company's overall risk profile? Is there overlap with other risk areas?

Oh, absolutely. There's a really clear symbiotic relationship emerging. ESG factors are increasingly being integrated into, for example, financial crime frameworks.

How does that work?

Well, think about it. Bribery, corruption, illegal logging or mining, pollution crimes, even things like carbon credit fraud, these are all financial crime risks, right? But they also have direct ESG dimensions, environmental impact, governance failures, social consequences. So, evaluating the ESG compliance of your suppliers actually helps you mitigate these traditional financial crime risks too. It adds another layer to your due diligence.

I see. So ESG compliance isn't just a separate track. It actually enables broader risk management like fighting financial crime and ensuring operational continuity.

Exactly. It's becoming a critical enabler for those broader objectives. Now integrating ESG clearly has benefits, reputation boost, better regulatory standing, attracting investors, even operational efficiency sometimes. But it's definitely not without challenges. Data is a big one. Getting consistent, reliable ESG data from suppliers can be tough. There's the risk of greenwashing companies overstating their ESG performance.

right? Saying the right things but not actually doing them.

Precisely. And there can be real barriers for smaller businesses, SMMES in meeting these requirements. All of this really underscores why organizations need to invest in technology tools for automated data collection and also prioritizing getting the raw data from suppliers rather than just relying on these opaque bundled ESG scores that some rating agencies provide. You need the granular detail to make real assessments.

And we have a stark reminder from our sources of what happens when this vetting fails. The Hyundai Motor incident in 2024.

Yeah. Powerful example.

US Department of Labor suing Hyundai and its suppliers because a 13-year-old girl was found working in the supply chain.

Yeah.

It just highlights a massive failure in third party vetting around labor practices.

And it shows the increasing scrutiny, especially in the US, on child labor within supply chains. It's not a theoretical risk. The consequences are very real, very public, and very damaging. Absolutely. Okay, let's transition to cyber security. Another huge piece of the TPRM puzzle. In 2025, it feels like cyber security isn't just about protecting your own internal network anymore. It's fundamentally evolved. Now it's about securing the whole extended enterprise, every vendor, every cloud platform, every external connection.

That's exactly right. It is a true paradigm shift. We've moved from that traditional model, you know, building walls around your internal network perimeter defense to a much more distributed security model. Organizations have to fundamentally rethink their strategies. You have to start treating your third party vendors as integral extensions of your own digital infrastructure.

So applying the same level of scrutiny you'd apply internally.

Pretty much. Yes. The same level of scrutiny, control, and defense mechanisms. Yeah.

This really necessitates a zero trust approach to any third party access.

Zero trust. Can you unpack that quickly?

Sure. Think of it as never trust, always verify. Don't assume access is safe just because it originates from a known partner or even seems to be internal. Verify every user, every device, every connection every single time based on strict policies regardless of where they are connecting from. It also means continuous assessment, not just checking vendor security once a year during onboarding and really getting your arms around those fourth party risks which Fenera also flagged. Who are their critical suppliers?

And the stats really back this up. Third party cyber incidents surged affected over 60% of companies in 2024 and projected to get worse in 2025.

The numbers are stark. Cyber criminals are actively targeting third parties. They see them often correctly as softer entry points. Maybe weaker security controls than the ultimate target organization.

What are the common weaknesses they exploit?

Primary weaknesses include things like:

  • unsecured APIs, the connections between systems.
  • compromised credentials of third party users, maybe stolen passwords.
  • just generally inadequate security hygiene among vendors.
  • and insufficient access controls or monitoring on the client side.

A single slip-up by just one vendor can open the door to truly devastating consequences for your organization.

So given this bigger riskier landscape, what are the best practices? How should companies reshape their cyber strategies for this extended enterprise? If you had to pick the most impactful first step?

that's a great question because it can feel overwhelming. Global regulations, GDPR, FPR, DORA, they're certainly pushing for stricter controls and the strategies for 2025 need to be layered, integrated, intelligence-driven. and proactive. But the single most impactful first step probably conducting really thorough security due diligence before you even sign the contract with a vendor.

Getting it right up front.

Exactly. Reviewing their security certifications, ISO 2701, SOC2 reports, looking at recent penetration test results, checking their incident history, using thirdparty monitoring services to get risk ratings. If you don't nail this pre-onboarding diligence, everything else is built on a shaky foundation.

Okay, diligence first. What comes after that?

After that, it's about ongoing vendor risk tracking, using external thread intelligence feeds, using behavioral analytics to spot anomalies for cloud vendors, using cloud security posture management, CSPM tools. These are like automated auditors continuously checking your cloud configurations and vendor access against best practices. Get real-time alerts.

So continuous monitoring, not just annual checks.

right? Then strictly manage access. Grant vendor access only on a need to know or at least priv basis implement strong identity and access management IAM embrace those zero trust principles we talked about maybe use micro segmentation to isolate vendor connections.

micro segmentation like creating small contained network zones.

exactly so if one segment is breached it doesn't easily spread also maintain and regularly update that centralized registry of all your vendors know who they are what they do what data they access their risk level categorize them based on criticality and make sure your third party incident response plans are tightly with your internal ones. Clear communication protocols, escalation paths, forensics guidelines. Know who does what when a vendor has a breach. And finally, contracts. Put clear security expectations, mandatory breach notification clauses, specific compliance requirements in all your vendor contracts.

Makes sense. Now, you mentioned AI earlier in the context of risk. How is AI playing out specifically in cyber security risk management for third parties? Seems like it could be a double-edged sword there, too.

It really is, but the adoption is happening fast. As we said, nearly half of organizations are already using AI in their broader CRM programs. In cyber specifically, AI is being used to process the huge volumes of security data telemetry coming from various tools. It's automating and enhancing third-party risk assessments, helping analysts sift through data faster. It's improving incident detection and response. And LLMs are being used, as mentioned, to find inconsistencies in vendor security documentation or questionnaire responses. The data shows AI use correlates strongly with higher cyber risk management maturity and better business outcomes.

But the other edge of the sword.

the other edge is again governance. Successful AI use needs robust data security and transparency and regulators like Fann are watching vendor use of Gen AI closely, demanding contract controls.

Right. Stopping vendors feeding your sensitive data into public models.

Exactly. So while AI can boost your cyber defenses for TPRM, uncontrolled AI used by your vendors can create brand new attack vectors or data privacy risks for you. Organizations need that sophisticated two-pronged AI strategy here, too. Use AI smartly for your own cyber TPRM and meticulously govern and audit how your vendors are using AI with your data or systems.

Got it. There was a quote from the AR Institute's 2025 report that really stood out to me. They said, "Cyber risk management is shifting from a compliance-driven obligation to a competitive differentiator". That feels significant.

It's a really powerful statement, and the report backs it up. It provides strong evidence that organizations doing certain things achieve better business outcomes.

Like what kinds of things?

Like quantifying cyber risk in financial terms, dollars and cents. Integrating cyber risk management, CRM, into broader enterprise risk management, ERM, automating risk management processes. Companies doing this report tangible benefits, actual risk reduction, more optimized cyber security spending, better alignment between security and business goals. So mature TPRM, especially the cyber security component, isn't just a cost center anymore. more. It's not just a reactive burden you have to deal with. It's becoming a strategic investment, one that yields measurable business value. It leads to better decisions, smarter resource allocation, enhanced credibility with partners and customers, and ultimately a more proactive and resilient cyber security posture.

which naturally leads us to how do you actually do all this? Navigating this complex regulatory web, the ESG demands, the cyber threats, it demands a strategic approach. Manual efforts just sound completely unsustainable.

You've hit the nail on the head. Manual out. Technology is no longer just helpful. It's a fundamental, absolutely indispensable requirement. You need it to effectively manage this evolving multifaceted TPRM landscape at any kind of scale. Significant investment in advanced integrated tech solutions is critical. You need automation for the repetitive stuff, real-time data collection and analysis, integrated reporting, even predictive analytics. Without tech enablement, you're essentially trying to scoop out the ocean with a thimble. It won't work. Okay, so let's get practical then. What are the key strategic imperatives? Let's start with governance and due diligence. What needs to be formalized?

All right, first you need a formal centralized third party risk policy. Define ownership clearly. Establish risk tiers for vendors. Define escalation paths for issues. Then implement that tiered approach to classifying vendors. Your critical high-risk partners need much more rigorous due diligence than say a low-risk supplier. Enhance your pre-engagement due diligence including specific ESG and security questionnaires upfront and embed robust safeguards in your contracts.

Like what kind of safeguards?

Explicit security expectations, breach notification clauses with clear timelines, compliance requirements tied to relevant regulations, and increasingly measurable ESG requirements or KPIs. Don't just ask if they have an ESG policy. Ask for metrics. And critically, don't forget the endgame. Define clear procedures for secure data return or destruction when a contract ends. How do you get your data back safely? How do you ensure they delete it?

That sounds like a lot to manage manually. What technologies support this formalization?

This is where tools like:

  • GRC platforms, governance, risk, and compliance.
  • Also, specialized due diligence automation tools.
  • vendor portals with built-in ESG and security questionnaires.
  • and contract life cycle management, CLM software to manage those all-important contracts.

These are foundational.

Okay. Next imperative, AI and automation. How does it fit in specifically? We've touched on it, but practically?

Practically it means moving AI beyond just pilots and experiments into full implementation where it makes sense. Use AI for predictive insights, spotting potential vendor issues before they blow up. Streamline processes. Leverage automation heavily for repetitive tasks, especially in compliance tracking and data collection from vendors. Use AI-driven risk scoring for automated continuous vendor risk profiling. And use those LLMs we talked about to rapidly analyze vendor documentation, questionnaire responses, even news feeds looking for inconsistencies or red flags. It's about empowering your human analysts to focus on higher level judgment, not return tasks.

Add the specific technologies enabling this.

We're talking:

  • AI-powered risk assessment tools.
  • LLM based document analysis platforms.
  • You also need AI governance frameworks to manage your own use of AI responsibly.
  • and AI audit solutions to check both your systems and potentially your vendors.

Makes sense. Moving on, building resilience. How do organizations get better at bouncing back or even avoiding disruption in the first place?

Resilience means shifting definitively from periodic checks to proactive continuous oversight. Implement tools for real time tracking of vendor cyber hygiene. Things like attack surface monitoring, understanding their exposed digital footprint, breach alert systems. Combine that with ongoing vendor risk tracking using external threat intelligence feeds, knowing if your vendor pops up in data breaches or dark web chatter. Ensure your third-party incident response plans are tightly integrated with your internal ones. Practice them together. And crucially, develop comprehensive exit and contingency plans.

More than just data return.

Yes. Cover data return destruction, but also identify potential backup providers in advance for critical services. What's plan B if your main vendor goes down or you need to terminate the contract quickly? And one more thing on resilience. Proactively scrutinize your extended ecosystem for geopolitical instability. Analyze who the ultimate beneficial owners, UBOs, of your vendors are. Look for regional concentration risks in your supply chain. Global events have local impacts.

What technology support building this kind of resilience?

Key tools here include:

  • attack surface monitoring platforms.
  • breach alert services.
  • external threat intelligence providers.
  • and robust business continuity planning, BCP software that incorporates thirdparty dependencies.

It really sounds like having a central place to manage all this is vital. Centralized platforms seem crucial.

Absolutely critical. You need to integrate TPRM into your broader GRC framework. Get that consolidated view of both internal and external risks. Utilize frameworks and software for compliance mapping tools that help you align vendor controls with multiple overlapping regulatory requirements. Dora, GDPR, FFIC, COC2, state laws, map once, assess against many.

That sounds efficient.

It has to be leverage data protection management systems DPMS or information security management systems ISMS like ISO 27,0001 frameworks to centralize compliance evidence and documentation. Use specialized vendor risk management VRM solutions. These often come with dashboards, workflow automation, vendor portals designed specifically for TPRM and for your cloud footprint. Cloud security posture management CSPM tools are essential for continuous monitoring of configurations and access related to cloud vendors.

and the key technologies enabling that central view.

  • GRC platforms are central.
  • compliance automation software.
  • DPM, SIMS frameworks and tools.
  • specialized VRM platforms.
  • and CSPM tools for the cloud piece.

But you know all the technology in the world won't work without the right culture.

the cultural transformation piece.

Exactly. Effective TPRM in 2025, maybe more than ever, requires a fundamental cultural shift. Risk management has to be seen and acted upon as a shared responsibility across all business units. It means actively fostering collaboration, getting compliance, legal, IT, procurement, and the actual business operations teams working together seamlessly on vendor risk. It means comprehensive internal training so everyone understands their role and ensuring TPRM is integrated smoothly into everyday business processes from selecting and onboarding vendors through ongoing monitoring right to offboarding them securely. It can't be an afterthought handled only by the risk team anymore.

It really sounds like a whole of business effort.

It has to be.

So, as we wrap up here, it's clear 2025 represents this critical inflection point for third party risk management. You've got tightening regulations in finance and data privacy, plus these rapidly expanding, increasingly mandatory ESG requirements. It's completely transformed TPRM from like a back office function to a central pillar, a pillar of organizational resilience and even strategic success.

That's the perfect way to put it. The ultimate goal, the overarching objective of doing TPRM well in 2025 is achieving that genuine enterprisewide resilience. It means ensuring that even though you rely heavily on external partners, your business can still consistently maintain operations, effectively protect its data, uphold its ethical and sustainability promises, and adapt quickly to new threats and regulatory shifts. Integrated TPRM isn't just a process. It's the fundamental pathway to achieving that kind of comprehensive adaptive resilience in what's clearly a pretty volatile world.

And going back to that fair institute report we mentioned, that quote about "shifting from a compliance-driven obligation to a competitive differentiator". It seems that's really the core message here.

It is.

organizations that are proactive investing in mature TPRM practices, really leveraging technology like AI and automation, formalizing their governance, fostering that collaboration across the business. they are seeing stronger outcomes.

That's what the data shows. Improved alignment with business goals, measurable risk reduction, smarter cyber security spending, better decision-making capabilities overall.

So effective TPRM isn't just about avoiding fines or bad press anymore.

No, not at all. It's really about driving tangible business value, gaining a significant strategic advantage. Actually, it leads to enhanced credibility with investors, customers, regulators, partners. It builds a more proactive, truly resilient security posture. and it improves decision-making right across the organization. All of that positions companies for sustainable growth and market leadership even when things get complex and uncertain.

So the final thought for everyone listening as you navigate this complex interconnected world of third party relationships. The question isn't just how do we meet these escalating compliance demands.

The real question is how will your organization truly thrive? How will you transform these challenges into a powerful competitive edge safeguarding your future in this rapidly changing landscape.

People on this episode

Head Shot

Linda Tuck Chapman (LTC)

Host