Bridging the Gap: What Moving From Regulator to Regulated Teaches Us About TPRM

Third Party Therapy Podcast — Series 1, Episode 1 — featuring Paul Huggett, Managing Director, Helios For the very first episode of Third Party Therapy, host Mike Day speaks with Paul Huggett, Managing Director at Helios and a former head of third party risk management (TPRM) at Lloyds Banking Group, Bank of Ireland and Nationwide Building Society. Having sat on both sides of the fence — as a buyer of pooled due diligence for over a decade, and now as a provider of it — Paul offers a rare, grounded view of what community due diligence really delivers, and where its limits are. From "Poacher" to "Gamekeeper" to Provider Paul's career path is itself a neat illustration of how TPRM as a discipline emerged almost by accident. Starting in operational and IT project management in the early 1990s, he moved into outsourcing project delivery — describing himself at the time as a "poacher," someone focused purely on moving functions quickly, for whom procurement was simply an obstacle. A move into internal audit at Lloyds Banking Group — auditing the sourcing and property functions — turned him into a "gamekeeper," and from there he spent a decade running third party risk functions across three major financial institutions, all of which were customers of Helios's FSQS scheme, before joining Helios itself roughly 18 months ago. Ten Years of Change in TPRM Paul's account of how far the discipline has moved is stark. His first supplier management audit revealed that "due diligence" at the time amounted to a signed letter from the supplier saying "everything's fine, thank you." The regulatory framework consisted of a handful of bullet points essentially saying "you can't outsource the risk." The period from roughly 2015 to 2018 — driven by GDPR, the growth of cloud outsourcing, and European regulators waking up to the risk — triggered rapid change, followed by growing UK regulatory focus (SS2/21 and PS7/21) on operational resilience, conduct risk, and more recently ESG, which Paul says has moved from "almost at the bottom of the pile" to near the top of the risk league table. What Pooled Due Diligence Actually Is Paul's explanation is refreshingly plain: the traditional model is a "many-to-many mesh" — every buyer individually asking every one of their suppliers largely the same questions, repeatedly. Pooled or community due diligence flips this into a one-to-many model: a supplier answers a shared, standardised question set once, and that data is made available (with the supplier's consent and quality-checked) to every buyer in the community who needs it. The win is symmetric. Suppliers spend less time repeatedly answering near-identical questionnaires from dozens of buyers. Buyers get a faster start, a broader pool of pre-assessed suppliers, and — critically — a question set that reflects a decade of collective input from the buying community, not just their own risk team's best guess. As Paul puts it, being able to tell your board "this is good enough for [named peer firms], therefore we believe it's good enough for us" is valuable air cover for a new entrant to the model. From Niche to Mainstream When Lloyds Banking Group first adopted the model, it was the only buying firm in the community — making it a hard sell to suppliers. Today, Helios's UK community includes just under 70 buying firms, plus roughly 20 more across Europe, spanning tiny building societies through to major international investment banks. Paul attributes the shift to sustained pressure on TPRM budgets and headcount ("you never get, as a TPR person, someone come to you and say... would you like some more people?"), combined with a regulatory turning point around 2018-2019 when European regulation first explicitly acknowledged shared assurance as acceptable — provided the buyer using it still applies its own risk appetite to the results, rather than simply outsourcing the decision. Confidentiality and Competition Law Two objections come up repeatedly with pooled models, and Paul addresses both directly. On confidentiality, where a supplier is unwilling to upload a sensitive document (such as a full cybersecurity policy) directly, Helios instead asks granular, structured yes/no questions about the specific controls contained within that document — meaning a buyer's risk specialist can still assess control coverage without the underlying document ever being shared. On competition law, Helios never discloses which buyers work with which suppliers to other buyers in the community, never comments on individual suppliers as a collective, and never directs buyers to take action against a specific supplier — all of which would risk anti-competitive behaviour. Not a Silver Bullet — Part of an Ecosystem Paul is careful to position pooled due diligence as one part of a wider TPRM toolkit, not a replacement for the buyer's own risk judgement. Helios provides primary, source-verified data (rather than scraped or blended third-party data), but the buyer still has to decide what matters to them and act on it. His framing: "we give you the information, but your job is to decide what to do with it." Real-World Stress Testing: Russia-Ukraine One of the clearest illustrations of the model's value came with the outbreak of the Russia-Ukraine conflict. Because Helios already held country of registration, operating location and fourth party data for its supplier community, buyer firms could establish their exposure "within about half an hour" of the event breaking — rather than manually cross-referencing finance systems to work out who they'd been paying, and where. Helios then issued a bespoke follow-up questionnaire to roughly 10,000 suppliers within about ten days, with an 80% response rate — giving buyers not just a static exposure map, but live intelligence on downstream impact. The same approach was repeated for the Israel-Gaza conflict and rolling energy blackouts. Where AI Fits — and Where Helios Is Deliberately Cautious Asked about AI, Paul draws a pointed comparison to cloud computing circa 2017-2018: a lot of noise, real underlying risk, but limited clarity on exactly where the exposure sits. Helios is building a new question set specifically to assess suppliers' use of AI, aligned to the EU AI Act's risk-based, proportionate approach. But Paul is candid that Helios itself is deliberately slow to deploy AI at scale in its own data pipeline, given its core value proposition rests on primary, verified data rather than scraped or AI-generated content — and flags the emerging industry concern that large language models may increasingly be trained on data that itself originated from other AI systems, creating a quality-degradation risk over time. Editorial note: the discussion of AI training data and model quality reflects Paul Huggett's own views and industry commentary referenced on the podcast, not an independently verified technical claim. Concentration Risk and the Regulator's Blind Spot Paul also touches on Critical Third Party (CTP) regulation and the new, more detailed outsourcing and DORA registers now required by UK and EU regulators — designed to help regulators identify concentration risk across the financial sector. He's candid that Helios, precisely because of the same competition and confidentiality constraints discussed earlier, cannot fill this gap entirely: it knows what a supplier does, but not what each buyer considers critical about that relationship, since criticality varies hugely between an insurer, a reinsurer, a building society and an investment manager. The Direction of Travel: From Data to Assurance Looking ahead, Paul sees the community model extending from data-gathering into genuine assurance — Helios has already introduced ESG benchmarking that lets suppliers see how they compare to peers, and has launched pooled, supplier-funded virtual site visits testing controls across the top operational risk domains. Notably, he observes that resistance to pooled assurance has historically come more from buyers wanting to "do things their way" than from suppliers, who are generally keen to spend less time on duplicate assurance requests. A Practical Starting Point For any organisation considering this path, Paul's advice is to look at your own organisation from the supplier's point of view: how many different, overlapping data requests are you sending out? Are you actually using everything you collect, or gathering data you never act on? And do you genuinely understand your broader (not just your most critical) supplier population — because, as Paul notes pointedly, "Covid did not care that it was taking out your workforce from a whole swathe of your medium risk suppliers." His clearest warning, drawn from watching organisations invest heavily in shiny new source-to-pay platforms: the technology is rarely the problem. "Systems and technology are not going to solve your problems. They're just going to give you a shinier problem to grapple with," unless matched with the cultural change and data discipline to actually populate and use them. Listen to the full episode of Third Party Therapy, produced in association with CeFPro, on Apple Podcasts, Spotify, Amazon Music, Audacy and YouTube, or visit thirdpartytherapy.com to subscribe to the mailing list. Tags #ThirdPartyTherapy #TPRM #CommunityDueDiligence #PooledDueDiligence #VendorRiskManagement #ThirdPartyRiskManagement #FSQS #SharedAssurance #DueDiligence #FinancialServicesRegulation #ConcentrationRisk #CriticalThirdParty #DORA #SupplierRiskManagement #RiskManagementPodcast #WhatIsPooledDueDiligence #HowDoesCommunityDueDiligenceWork #TPRMPodcast