Third Party Therapy

Dropping the SBOM: Why TPRM Needs to Look Inside the Software It Buys

Mon, 26 Oct 2026 23:46:33 GMT

Third Party Therapy Podcast — featuring Charlie Jones, Director of Product Management, ReversingLabs

New paragraph

Bridging the Gap: What Moving From Regulator to Regulated Teaches Us About TPRM

Sun, 04 Oct 2026 22:04:19 GMT

Third Party Therapy Podcast — featuring Dharminder Mehmi, third party risk specialist, Legal & General

Few people in third party risk management (TPRM) have sat on both sides of the regulatory relationship. In this episode of Third Party Therapy, host Mike Day speaks with Dharminder Mehmi, who spent around 21 years at the FCA and its predecessor — including several years in specialist technology resilience and cyber roles — before moving into industry, first at Virgin Money and now at Legal & General. All views shared are personal and don't represent any employer or institution.

Twin Peaks: PRA and FCA, What's the Difference?

Dharminder explains the UK's "Twin Peaks" regulatory model, created after the single Financial Services Authority was split in the wake of the financial crisis. The Prudential Regulation Authority (PRA) covers banks, building societies, insurers and a small number of PRA-designated investment firms, focused on safety and soundness — principally, can depositors and policyholders be paid when they need to be. The Financial Conduct Authority (FCA) covers conduct for all regulated financial services firms, and is the sole prudential regulator for firms outside the PRA's remit, such as standalone asset managers. Its objectives centre on consumer protection, market integrity, and competition.

Proportionality: Same Rules, Different Expectations by Size

Both regulators apply their requirements proportionately. The largest, most systemically significant firms are expected to meet the "gold standard" of market practice; smaller firms face less stringent expectations, though they remain subject to the same underlying rules.

How Regulators Are Structured

Supervision at the FCA is organised by sector specialism — retail banking, wholesale and investment banking, payment services, asset management, life insurance and so on — supplemented by cross-cutting specialist teams (client assets, prudential, technology resilience and cyber) who get pulled into supervisory conversations as needed. For complex groups spanning multiple regulated entities, a "group supervision" model applies, led by whichever part of the business is most significant, drawing in other specialist teams as required. Dharminder notes that specialists in areas like technology resilience get genuine cross-firm visibility — seeing how, say, a major retail bank and a major investment firm each approach the same underlying problem — which feeds directly into what "good practice" looks like across the industry.

Crossing the Floor: What Moving From FCA to Industry Revealed

Dharminder describes the move from regulator to practitioner as "refreshing" and an "eye opener" in equal measure. At the regulator, firms present their most polished, C-suite-level version of their controls; inside a regulated firm, by contrast, "you've got the bonnet open" with no room to hide. Virgin Money specifically hired him, he says, for his insider knowledge of what the regulator considers good practice — knowledge he could then apply directly to TPRM, and to broader transformation programmes such as mortgage technology initiatives.

From Outsourcing to Materiality: The Regulatory Patchwork

Dharminder traces how the UK's rules have evolved. The FCA's requirements sit in SYSC 8, which he describes as relatively high-level and light on detail around exit planning or materiality assessment, and apply mainly to material outsourcing specifically. The PRA's outsourcing and third party risk requirements, introduced in March 2021, are more prescriptive and better aligned to the full third party risk lifecycle — plan, evaluate, select, contract, onboard, manage and monitor, exit. Critically, Dharminder notes that in practice, firms quickly stopped worrying much about whether an arrangement technically counted as "outsourcing" at all, since the real driver became materiality — the same rigour now typically applies to material third party arrangements whether or not they meet the formal outsourcing definition. DORA, in his view, draws together the best of the PRA's resilience-focused approach, the UK's operational resilience regime, and elements of the emerging Critical Third Party regime, into a single EU-wide framework — which, given the number of member states involved, helps explain why it took years to finalise before going live in January 2025.

Critical Third Parties: A New Kind of Oversight

The UK's Critical Third Party (CTP) regime gives regulators limited direct oversight over a small number of systemically significant technology providers, without diluting any firm's own due diligence obligations. Dharminder's sense, from industry conversations at events such as Deloitte roundtables and CeFPro conferences, is that the firms likely to be designated already operate to a standard broadly in line with what regulators will expect — the value lies less in forcing improvement and more in giving regulators a faster, more direct line of sight into systemic concentration risk, rather than needing multiple financial institutions to each independently investigate the same provider after an incident.

The Horizon Risks: AI and Quantum

Looking ahead, Dharminder flags that none of the current regulatory frameworks directly address generative or agentic AI in detail, even as the EU AI Act and FCA sandboxing initiatives explore the space. He expects TPRM programmes to be increasingly challenged by both AI's rapid evolution and longer-term developments such as quantum computing, alongside the continued risk of supply-chain shocks nobody saw coming — citing the July 2024 CrowdStrike outage as a reminder that genuinely global disruption can originate from a vendor most firms would never have flagged as "critical."

The One Area Still Lagging: Fourth Party Visibility

Asked where the industry still has the furthest to go, Dharminder points squarely at supply chain and fourth party visibility. The CrowdStrike outage disrupted systems worldwide within hours, and many affected firms only then discovered how deeply embedded a subcontractor they'd never classified as material actually was in their own technology stack. His recommendation: push third parties for genuine visibility into their own subcontractors, embed contractual rights to be notified of material subcontractor changes, and give senior management clear visibility of concentration risk — for example, how much of the technology estate ultimately rolls up to a small number of major cloud providers.

Lessons Learned: TSB and Intra-Group Risk

Dharminder's clearest cautionary example is the TSB migration incident of 2018, where the enforcement notice found at its root a failure to apply sufficient rigour to an intra-group service provider. His point: firms are often diligent about third parties like IBM or a custodian bank, but can overlook that an intra-group service company (common in UK ring-fenced banking groups) should, under the rules, be treated with no less scrutiny than an external provider. He also flags that firms operating across multiple jurisdictions need to be alert to third party and resilience regulation beyond the UK — even a small overseas office can bring additional, sometimes less familiar, local requirements into scope.

Getting Started: The Basics for Newcomers

For anyone new to TPRM in a regulated environment, Dharminder's starting checklist is straightforward: a clear policy for managing third party arrangements; a consistent risk segmentation approach (material/high/medium/low or equivalent); due diligence and review frequency genuinely proportionate to that segmentation; documented exit and contingency plans for services supporting important business services; and increasingly, genuine testing of those exit plans with the third party involved — not just a desktop exercise, but active testing with providers such as custodian banks or middle-office partners, reflecting the level of rigour now expected of larger, more sophisticated firms.

Listen to the full episode of Third Party Therapy, on Apple Podcasts, Spotify, Amazon Music, Audacy and YouTube, or visit thirdpartytherapy.com to subscribe to the mailing list.

### Tags

#ThirdPartyTherapy #TPRM #FinancialServicesRegulation #DORA #PRARegulation #FCARegulation #CriticalThirdParty #OperationalResilience #ThirdPartyRiskManagement #IntraGroupRisk #SupplyChainRisk #CrowdStrike #TSB #RegulatoryCompliance #RiskManagementPodcast #WhatIsTheDifferenceBetweenPRAAndFCA #HowDoTPRMRegulationsWork #TPRMPodcast

Established Players and New Entrants: Mapping the TPRM Technology Landscape

Sun, 04 Oct 2026 22:00:53 GMT

Third Party Therapy Podcast — featuring Harj Mattu, Partner, Deloitte

The third party risk management (TPRM) technology market has moved a long way from spreadsheets and SharePoint — but it's also more fragmented than ever. In this episode of Third Party Therapy, host Mike Day speaks with Harj Mattu, a Deloitte partner specialising in third party management technology and transformation, about the state of the TPRM technology market, where AI is actually showing up, and the lessons learned from implementations that have gone wrong.

There Is No Silver Bullet

Harj's central message is that TPRM technology should be thought of as a toolkit, not a single platform. Even the strongest solutions typically need augmenting — a best-in-breed TPRM workflow tool like Aravo or Process Unity will usually need integration with external data intelligence providers and sourcing or buying systems, while a procurement-rooted platform may offer less mature native TPRM capability than a specialist tool.

The Established Players

Harj names the vendors that consistently appear in client shortlists across sectors: Aravo and Process Unity remain fixtures in "best practice, end-to-end" conversations, with Process Unity, in his reading of external market research, having edged ahead recently. Coupa Risk Assess retains strong functional capability, though Harj notes its user experience can be a trade-off. OneTrust and ServiceNow have both invested significantly in their own TPRM capability in recent years.

New Entrants Pushing the Market

Harj highlights CERTA as a vendor doing something genuinely different — not just using AI to support risk assessment, but using AI to help configure and deploy the workflow itself, generating a tailored risk assessment workflow for a given category or risk domain rather than requiring extensive manual setup.

Data Aggregators and Screening Providers

Beyond workflow tools, Harj points to a growing category of data intelligence aggregators — he names Interos, Supply Horizon and Craft — which combine data from multiple sources to support a risk assessment end to end, sitting alongside longer-established screening providers such as Dun & Bradstreet and Refinitiv

Industry Differences: Regulated vs Less-Regulated Sectors

Harj observes that heavily regulated sectors — financial services, life sciences, healthcare — tend to gravitate toward tried-and-tested vendors, partly because buyers want proof of a track record with comparable, similarly regulated organisations, and partly because of the growing regulatory expectation (he cites DORA and similar regimes) that risk assessments trace clearly through into contract terms and ongoing monitoring. Less regulated sectors — retail and some technology companies among them — are often more willing to take a chance on smaller, newer vendors.

Where AI Is Actually Showing Up

Harj is candid that AI adoption within TPRM technology specifically has lagged behind other domains, such as contract lifecycle management, where use cases for data extraction are more established. Within TPRM today, he sees AI most concretely in document and evidence review (automating what was previously manual evaluation of supplier-submitted evidence), and in orchestration — providing a single front door for business users who would otherwise have to navigate multiple disconnected tools. He sees the next frontier, agentic AI actually running parts of a standardised risk assessment process end-to-end, as a significant opportunity that the market hasn't yet fully delivered on.

Orchestration: The "Amazon Experience"

Harj names Zip, Oro and ServiceNow as vendors receiving significant investment and attention in the orchestration space specifically — aiming to give business users a single, seamless front end, similar to a retail checkout experience, that routes a request to the right underlying process (procurement, TPRM, or both) without the user needing to understand the distinction.

Procurement vs TPRM: A Growing Technology Divergence

Echoing a theme from earlier episodes with Oliver Jones, Harj estimates — based on his own client engagement experience rather than published research — that the proportion of organisations he works with that keep TPRM technology strategy separate from procurement has grown from roughly 40% to as much as 60-70% over the past year, driven by TPRM's expanding scope into intermediaries, distribution partners, agents, and even sell-side customer risk.

Lessons Learned: Overcomplicating the Questionnaire

Asked for the single biggest implementation mistake he's seen repeatedly, Harj points to scope creep in questionnaire design — risk domain owners, each passionate about their specific area, piling additional questions into an assessment until the user experience collapses under its own complexity, regardless of how flexible the underlying technology is. His clear advice: resist adding every stakeholder's request, and keep the assessment proportionate to genuine risk.

Lessons Learned: Reporting as an Afterthought

A second recurring gap: TPRM platforms are generally strong workflow tools but weaker reporting tools, and organisations that don't plan their data model and reporting strategy from the outset often find themselves unable to produce the board-level, regulator-ready reporting they need without extensive manual rework.

Getting Started: Prioritise Where Value Comes From

Harj's practical advice for anyone planning or refreshing a TPRM technology strategy: map the end-to-end process and honestly assess which capability (workflow, screening, reporting, data aggregation) would deliver the most value for your organisation's specific maturity stage, rather than trying to improve everything simultaneously. Most organisations, he notes, are now well aware that this is a multi-vendor "jigsaw" rather than a single-platform decision — the discipline now is in sequencing that jigsaw sensibly.

Listen to the full episode of Third Party Therapy, on Apple Podcasts, Spotify, Amazon Music, Audacy and YouTube, or visit thirdpartytherapy.com to subscribe to the mailing list.

### Tags

#ThirdPartyTherapy #TPRM #TPRMTechnology #ThirdPartyRiskManagement #VendorRiskManagement #RiskManagementTechnology #OrchestrationTools #AIInTPRM #AgenticAI #ProcessUnity #Aravo #ServiceNow #OneTrust #DataAggregation #RiskManagementPodcast #WhatTPRMSoftwareShouldIUse #HowIsAIChangingTPRM #TPRMPodcast

Should TPRM and Procurement Sit Together? The Evolution of Third Party Management

Sun, 04 Oct 2026 21:57:10 GMT

Third Party Therapy Podcast — featuring Oliver Jones, H&Z

Third party risk management (TPRM) grew up as a subset of procurement — but does it still belong there? In this episode of Third Party Therapy, host Mike Day speaks with Oliver Jones of H&Z about how the relationship between TPRM and procurement has evolved, where organisations are getting the structure right (and wrong), and what technology could do to bring the two back together.

From Procurement Subset to Parallel Discipline

Oliver, who moved from general procurement into TPRM-heavy roles at organisations including Coventry Building Society, Bank of Ireland and Santander International, sees the split happening for two main reasons: growing C-suite understanding of TPRM as a distinct discipline, and the sheer scope of what counts as a "third party" expanding well beyond traditional suppliers to include intra-group arrangements, which sit awkwardly within a conventional supplier relationship management (SRM) process. He's clear this isn't one-size-fits-all — for smaller or less global organisations, keeping TPRM embedded within a strategically-run procurement function can work perfectly well, provided the underlying framework and governance are solid.

A Capacity Problem as Much as a Structural One

As regulatory requirements deepen — DORA, fourth party mapping, operational resilience — Oliver argues that asking a generalist procurement or SRM person to absorb this "side of desk" simply doesn't scale. Dedicated capacity becomes necessary once the depth of obligation increases, regardless of where the function formally sits.

Should We Rebrand "Risk" as "Resilience"?

Mike raises a reframing some organisations have adopted: calling the function "third party resilience" rather than "third party risk management," on the basis that resilience carries more positive, visionary connotations. Oliver is sympathetic but cautious — in one conversation, an organisation keen to talk about "resilience" had very little actual framework in place to test. His analogy: it's a bit like calling a function a "centre of excellence" before it's genuinely excellent — aspirational language is fine, but only once the underlying capability can back it up.

Where TPRM Sits in the Org Chart

Oliver and Mike compare notes on reporting lines they've each seen: procurement and TPRM under a CFO, a COO, a CIO, or increasingly under whichever executive holds the relevant Senior Management Function (SMF24) accountability to the regulator. Oliver notes that TPRM often occupies an ambiguous "line 1.5" position — more rigorous than pure first-line operational ownership, but rarely a fully resourced, independent second line function in its own right.

The Technology Fragmentation Problem

One of the clearest practical frustrations Oliver raises: the same operational stakeholder can find themselves dealing with several different teams and tools for what feels, from the business's point of view, like one relationship — an enterprise risk repository for emerging risks, a ServiceNow-style workflow tool for audit trail, a source-to-contract procurement platform, and a separate contract repository. Multiply that by multiple regions in a global organisation, and the fragmentation compounds further.

Who Should TPRM Recruit From?

Picking up a long-running debate, Mike shares that at one conference an audience vote came out strongly in favour of recruiting TPRM talent from risk and audit backgrounds over procurement — a view Mike admits he argued against. Oliver has seen both work, noting that candidates arriving from a second- or third-line risk or audit background bring a different, complementary strength to those with a procurement grounding.

Reversing the Workflow: Should TPRM Be the Front Door?

Mike puts forward a provocative idea: given TPRM's scope now often exceeds procurement's (covering intra-group relationships and lower-value but still risky engagements procurement wouldn't touch), should the TPRM intake process become the organisation's genuine front door — triggering procurement as a downstream sub-process, rather than the reverse? Oliver agrees with the underlying principle of early, multi-criteria engagement, and points to Hellios FSQS as an example of a shared front-end assessment that already blends risk and commercial due diligence for suppliers common across the financial services buying community — benefiting both sides, since suppliers familiar with the standard question set are typically more comfortable and responsive.

Business Partnering and the "Amazon-Like Experience"

Both agree the ambition should be a single, intuitive third party intake experience — regardless of whether the eventual process branches into procurement, TPRM, data privacy or elsewhere — so the business doesn't experience friction from dealing with multiple teams asking overlapping questions. Oliver references early-stage "agentic" intake tools he's seen demonstrated that adapt their questions based on context (spend threshold, data sharing, deployment model), directing a request down the right path automatically.

Post-Award: Keeping the Relationship Joined Up

The conversation turns to the ongoing lifecycle after contract signature — renewal negotiation, periodic due diligence, and performance management are all interlinked in practice, even when owned by separate teams. Oliver notes that most contracts run for around three years while the sourcing process itself might only take six months — meaning the overwhelming majority of value (and risk) accrues in a period that gets comparatively little structured attention.

The Danger of "Low Risk" Suppliers That Grow

Oliver flags a genuine blind spot: organisations invest heavily in classifying suppliers at onboarding, but rarely revisit that classification, even as a "low risk" supplier's usage and dependency grows substantially over time. The biggest risk, in his view, isn't a risk event itself — it's TPRM's own classification process not being rigorous or current enough to have flagged it. He advocates periodically self-challenging past classifications — a "friendly audit" — rather than waiting for a formal internal audit review, which he notes is rarely deeply specialised in third party risk specifically.

Lessons Learned

Oliver shares two cautionary examples: a client who attempted a TPRM transformation without external input, misinterpreted regulatory requirements, and had to unwind and restart elements of their policy and classification framework; and a rollout where a new assessment and questionnaire were pushed out to hundreds of operational stakeholders with poor change communication and no guidance embedded in the questions themselves — damaging internal goodwill towards the function before it had even properly started.

Getting Started

Oliver's recommended first step for any organisation looking to realign TPRM and procurement: go directly to stakeholders and map root causes of friction — where the pain points genuinely are — rather than assuming the fix is People, Process or Technology in isolation. From there, look specifically at synergies in the post-award, supplier relationship management space, and consider whether a single, consistent voice to the business (whichever function leads it) would reduce duplicated effort and frustration.

Listen to the full episode of Third Party Therapy, on Apple Podcasts, Spotify, Amazon Music, Audacy and YouTube, or visit thirdpartytherapy.com to subscribe to the mailing list.

### Tags

#ThirdPartyTherapy #TPRM #ProcurementAndTPRM #ThirdPartyRiskManagement #SupplierRelationshipManagement #OperationalResilience #RiskClassification #VendorRiskManagement #DORA #SS221 #TechnologyOrchestration #BusinessPartnering #ConcentrationRisk #RiskManagementPodcast #ShouldTPRMSitWithProcurement #HowToStructureTPRM #TPRMPodcast

Escrow in the SaaS Era: Valuable Resilience Tool or Box-Ticking Exercise?

Sun, 04 Oct 2026 21:55:00 GMT

Third Party Therapy Podcast — featuring Nathan Hopkins, Chief Revenue Officer, The Escrow Company

Software escrow has a reputation problem: many third party risk management (TPRM) professionals see it as something you put in a contract and then never think about again. In this episode of Third Party Therapy, host Mike Day speaks with Nathan Hopkins of The Escrow Company about how escrow has evolved for the SaaS era, and how to make sure it's a genuine resilience tool rather than a box-ticking exercise.

From Source Code to SaaS

Traditional software escrow is straightforward: a vendor licensing software to an end user deposits their source code with an independent escrow agent, so the customer can keep maintaining the software if the vendor fails. SaaS fundamentally changes the risk, because the provider is now responsible for far more than code — availability, infrastructure, and the functionality of a live service the customer never directly controls. Nathan's own career bridged data centre and managed service environments before joining The Escrow Company roughly in line with the industry's shift toward cloud adoption.

Four Models for SaaS Escrow

Nathan sets out a spectrum of approaches, which can be combined depending on the risk:

- Traditional deposit — source code plus the additional materials a SaaS product needs to be meaningfully rebuilt: customer data, deployment scripts, infrastructure-as-code, and pre-configured containers or snapshots.
- Access/credentials escrow — for single-tenant deployments, depositing credentials to the existing live production environment (typically hosted on AWS, Azure or similar), so a beneficiary can take over billing and ownership of an already-running system rather than rebuilding from scratch.
- Secondary environment — a standby environment, controlled either by the vendor or the escrow provider, kept ready to take over.
- Fully managed service — the escrow provider takes on redeployment and ongoing operational management of the solution following a trigger event.

Nathan is clear escrow typically protects against business-led failure (insolvency, breach of contract, inability to support the product) rather than a pure technical disaster, which should still sit within the vendor's own backup and disaster recovery planning.

The Airline Case Study

Nathan describes (without naming the airline) a customer facing exactly this scenario: a third party provider delivering its core, revenue-generating flight booking system went into administration. Because the airline had invested in the managed escrow option, Nathan's team redeployed a replica of the solution and ran it for roughly three months — including a DNS failover that Nathan says produced zero downtime for the airline's customers — while the airline made a longer-term plan, ultimately bringing the capability in-house and hiring some of the affected vendor's staff.

Making Escrow Work: Testing Is Everything

Nathan's clearest message is that escrow only has value if it's verified. Historically, two things undermined escrow: deposits falling out of date, and beneficiaries lacking the operational resource to actually use materials even once released. His organisation now runs automatic, frequent (often daily) deposits tied to production versions, and offers verification services ranging from witnessing and documenting a vendor's own rebuild process, to independently repeating that rebuild themselves and inviting the beneficiary to run functional tests against the replica — for example, confirming a flight can actually be booked through the rebuilt system.

He shares a cautionary example: a customer who was also an investor in a software company deposited materials into escrow but declined formal verification. When the vendor later failed and the materials were released, the customer discovered files were missing — something Nathan says routine testing would have caught.

Who Owns the Escrow Relationship?

Mike and Nathan discuss a shift in ownership: rather than escrow being bolted on as a one-off contractual clause during supplier negotiation, financial institutions in particular are increasingly treating the escrow relationship itself as something the customer owns and manages strategically across a multi-vendor portfolio — partly driven by regulators such as the PRA and equivalents overseas (DORA in the EU) requiring firms to address supply failure risk, including insolvency, directly.

Handling Personal Data in Escrow

Because SaaS deposits can include customer data, Nathan describes using encrypted deposits where the escrow provider holds no decryption key — the beneficiary alone holds that — as one mechanism for managing GDPR and data sensitivity concerns without compromising the ability to recover a service.

What Happens When Escrow Is Invoked

Invocation isn't instant. A beneficiary triggers a claim (for example, alleging insolvency); the depositor is given the opportunity to accept or dispute it; disputes that can't be resolved between the parties can ultimately go to the courts, since the escrow agent remains strictly impartial and does not adjudicate. Nathan notes some contracts pre-agree conditions under which certain release processes can bypass dispute altogether.

Rollbacks and Historical Versions

Because the escrow company typically stores a rolling history of deposits (Nathan cites roughly a year of daily deposits under some models, plus permanently retained verified copies), a rollback to an earlier version is often possible if a recent update caused the underlying problem.

AI and the Future of Escrow

Asked about AI's impact, Nathan is candid that the market is still in an early, "prove it first" adoption phase, similar to the early days of cloud. Fundamentally, AI platforms still rely on data, which escrow can still protect — but he flags that the growing scale of AI training data, and the IP and licensing questions around who owns what, will be a genuine emerging challenge for the escrow model to address as adoption matures.

Lessons Learned

Nathan's clearest advice: go into an escrow arrangement with your eyes open about what you actually want to achieve and what risk you're addressing, rather than treating it as a standard contractual afterthought bolted on late in negotiation. Organisations that get the most value tend to standardise their approach across vendors, decide upfront which models suit which criticality of service, and — critically — commit to testing and verification rather than assuming a deposit alone is sufficient protection.

Listen to the full episode of Third Party Therapy, on Apple Podcasts, Spotify, Amazon Music, Audacy and YouTube, or visit thirdpartytherapy.com to subscribe to the mailing list.

### Tags

#ThirdPartyTherapy #TPRM #SoftwareEscrow #SaaSEscrow #OperationalResilience #ThirdPartyRiskManagement #VendorRiskManagement #DORA #BusinessContinuity #DisasterRecovery #ExitPlanning #SupplierFailure #ContractualResilience #RiskManagementPodcast #IsEscrowWorthIt #HowDoesSaaSEscrowWork #TPRMPodcast

Why Is There a Shortage of TPRM People?

Sun, 04 Oct 2026 21:44:13 GMT

Inside the Recruitment Market for Third Party Risk Talent - Third Party Therapy Podcast - featuring Jack Birch, Head of Interim Management Practice, and Will Cook, Senior Consultant, Procurement Heads

Third party risk management (TPRM) has grown rapidly as a discipline — but has the talent pool kept pace? In this episode of Third Party Therapy, host Mike Day is joined by Jack Birch and Will Cook of recruitment specialist Procurement Heads to discuss the TPRM hiring market, why demand is outstripping supply, and why almost nobody grows up wanting a career in third party risk.

A Decade of Rising Demand

Both guests have watched demand for TPRM talent climb steadily. Jack, who leads interim recruitment, has seen a significant uplift in briefs for quality TPRM hires, often framed as "we're struggling to find this person." Will traces a clear inflection point to around 2021-2022, when a single client ran a project recruiting eight roles tied to the SS2/21 and PS7/21 operational resilience regulations — a scale of TPRM-specific hiring that simply hadn't existed in the market before.

Spiky Demand, and Interim as the Bridge

Demand tends to move in peaks and troughs, often driven directly by regulatory change — SS2/21 historically, and more recently DORA. Jack notes a real split in client behaviour: some organisations plan six to twelve months ahead of a known regulatory deadline and start upskilling or resourcing early; others only react once a deadline is imminent, sometimes almost by accident discovering a regulation is about to bite. This is where interim hires come in — often a senior, more expensive specialist brought in to build a framework from a "greenfield" starting point, before handing over to a more junior permanent hire once the programme is established and running.

More Demand Than Supply

Both guests agree the market currently favours candidates. Jack attributes this partly to the sheer number of organisations that didn't have a formal TPRM function even two years ago but do now, meaning the pool of genuinely experienced practitioners hasn't grown fast enough to match new demand. Practically, this means good TPRM people are often not actively job-hunting at all — they're in the "passive" market, and need to be headhunted directly with a compelling, specific opportunity rather than reached through a generic job advert.

Where TPRM People Actually Come From

Rather than a single feeder profession, Jack and Will see TPRM talent arriving from several directions — most commonly from procurement, particularly IT category management, given its natural overlap with regulatory frameworks like DORA that carry a strong technology and cyber lens. Will also sees hiring managers deliberately recruiting "sideways" from adjacent risk disciplines — enterprise risk, anti-money laundering — on the basis that a strong risk mindset and stakeholder communication skills can be taught the specific regulatory detail, even where a candidate's CV doesn't match the job description word for word.

Beyond Financial Services: Manufacturing and Supply Chain Risk

While financial services remains the most mature TPRM market, both guests are seeing early signs of similar roles emerging in manufacturing and FMCG, often under titles like "supply chain risk manager." Jack recounts one insurance client pricing a newly created supply chain risk role at roughly £45,000-£50,000, only to be told candidates already earning double that might consider a conversation — a sign of just how far pricing expectations can be out of step with market reality in a newly maturing niche.

ESG and Sustainability: A Growing but Immature Niche

Will notes strong candidate interest in ESG, sustainability and ethical sourcing roles within supply chain risk, but sees organisations lagging behind in creating dedicated headcount for it. Both guests, along with Mike, discuss how ESG differs from other TPRM risk domains in being driven more by genuine organisational culture and values than by the threat of regulatory fines — something Mike suggests should, ideally, be championed on its own merits rather than only when a specific legislative deadline (such as CSRD or CSDDD) forces the issue.

Fragmented Titles, Fragmented Structures

Job titles in this space vary enormously — a "supplier relationship manager" at one firm might be doing the work of a procurement manager and a third party risk manager combined. Will notes that larger organisations tend to have more clearly defined, separate roles, while small and medium-sized businesses more commonly have people wearing multiple hats, which Will frames positively as opening up varied career pathways even if it reflects a less mature structure.

Why the Talent Pool Stays Small

Both guests point to a lack of basic awareness as the single biggest barrier to entry. Neither recalls meeting anyone who grew up wanting to be a third party risk manager — the discipline simply isn't visible or championed as a career option to school leavers, university students, or even many procurement professionals until they stumble into it. Will adds a related structural issue: hiring managers often expect a first TPRM hire to already understand specific regulations in depth, which can unfairly screen out candidates with strong transferable risk or communication skills who could be upskilled relatively quickly.

Common Recruitment Mistakes

Jack's clearest lesson from recurring client conversations: organisations often "blame the market" for a failed permanent search, when the real issue is a mismatch between expectations (seniority, experience, timeframe) and the salary or day-rate on offer. His advice is to fail fast and adjust rather than leave a role unfilled on the market for months. Will adds that rigid job specifications are a common trap — being open to hiring a less experienced but sharp, fast-learning candidate, rather than insisting on someone who's "been there and done it," often produces a better long-term outcome.

Advice for Organisations Starting a TPRM Search

Jack and Will's shared advice: do genuine market research before going out to hire — understand who else is competing for the same talent, and get a realistic read on pricing and availability rather than relying on a generic salary benchmark search. Specialist recruiters can offer impartial, experience-based input even outside a formal placement, and getting the role "right the first time" avoids the credibility problem of a vacancy that's visibly been open for months. Fundamentally, both stress understanding what challenge the hire needs to solve before writing the job spec at all.

Listen to the full episode of Third Party Therapy, on Apple Podcasts, Spotify, Amazon Music, Audacy and YouTube, or visit thirdpartytherapy.com to subscribe to the mailing list.

### Tags

#ThirdPartyTherapy #TPRM #TPRMRecruitment #ThirdPartyRiskManagement #ProcurementCareers #TalentShortage #RiskManagementCareers #InterimManagement #ESGCareers #SupplyChainRisk #VendorRiskManagement #DORA #SS221 #CareerPathways #RiskManagementPodcast #WhyIsThereAShortageOfTPRMPeople #HowToHireForTPRM #TPRMPodcast

From Annual Assessment to Continuous Monitoring: Rethinking Cyber Risk in Your Supply Chain

Mon, 14 Sep 2026 22:08:01 GMT

Third Party Therapy Podcast — featuring Stephen Boyer, Co-Founder and Chief Innovation Officer, BitSight

Cyber criminals don't operate on an annual review cycle — so why do so many third party risk management (TPRM) programmes still assess supplier cyber risk that way? In this episode of Third Party Therapy, host Mike Day speaks with Stephen Boyer, co-founder and Chief Innovation Officer at BitSight, about how the cyber threat landscape has evolved, and what that means practically for anyone managing supply chain risk.

From Clumsy to Military-Grade

Stephen opens with a striking frame, referencing a recent Wall Street Journal report on how certain nation-state cyber actors have "graduated from clumsy corporate thieves to military weapons." His broader point: sophisticated, nation-state-level attacks are no longer confined to government targets. Regional airports, water utilities, oil and gas processing facilities — ordinary commercial and civic infrastructure — now sit squarely in scope, because compromising them can serve broader geopolitical or military aims.

He also points to a documented pattern from the Russia-Ukraine conflict: cyber operations frequently preceding or accompanying physical ("kinetic") military action, often disabling communications infrastructure ahead of a battlefield advantage. Separately, attacks — often disguised as ransomware but functioning as "wiperware," designed purely to disrupt rather than extract payment — have hit organisations with no direct connection to the conflict theatre at all.

Are Breach Claims Sometimes Exaggerated?

Mike raises a sharp, practical question: does the scale of data breaches claimed on the dark web sometimes get inflated for reputational effect by the attackers themselves? Stephen's answer is nuanced — he acknowledges some exaggeration does occur, particularly where an organisation has refused to pay a ransom, but points to a countervailing dynamic: attackers have a commercial incentive not to publish stolen data if the ransom is paid, since publishing anyway would undermine trust in their "business model" for future victims. He cites the Medibank breach in Australia — where sensitive medical data on millions of Australians was ultimately linked, according to police, to more than 10,000 downstream crimes — as an example of how genuinely damaging under-reported breaches can be.

Third Parties: Strengthening Security and Concentrating Risk at the Same Time

Asked whether the growing use of cloud and SaaS third parties is increasing or decreasing organisational cyber risk, Stephen's answer is "a mix of both." Consolidating infrastructure with major, well-resourced cloud providers generally raises the baseline security bar compared to organisations running their own servers and mail systems. But it also concentrates risk: a single vulnerability at a widely-used provider can simultaneously expose thousands of downstream customers, some of whom may become collateral victims without ever being directly targeted. Even Microsoft itself, he notes, has repeatedly been a direct target of major attacks — scale is not the same as immunity.

The Shift From Point-in-Time to Continuous Monitoring

The heart of the episode is Stephen's case for continuous, data-driven monitoring over the traditional annual (or less frequent) due diligence questionnaire. His figure: BitSight's data suggests a major security event — a significant vendor vulnerability disclosure — occurs roughly twice a month across the vendor landscape it monitors. An annual assessment cycle is, by definition, incapable of catching most of these in a timely way.

He illustrates the practical value of continuous, portfolio-wide visibility with two real incidents:

• MoveIt — a file transfer tool exploited via a serious vulnerability. Stephen's team identified roughly 1,200 instances of the software across the internet — a concentrated, identifiable footprint. Crucially, several further vulnerabilities in the same product followed the initial one, meaning organisations that believed they'd already patched could still have been exposed by a later flaw, or could have been compromised before their patch was even applied.

• CrowdStrike — the widely reported outage caused by a faulty update to an endpoint protection agent running on millions of devices. BitSight used network traffic analysis (observing devices "beaconing" to CrowdStrike's update servers, then going silent) to help customers work out, within hours rather than weeks, which of their suppliers were likely affected — a question that would otherwise require contacting every third party individually.

The Case Study: NASA and a 50% Efficiency Gain

Stephen offers NASA as a concrete illustration of scale: the organisation must conduct cybersecurity due diligence across roughly 3,000 suppliers. Working with BitSight's tooling for visibility, workflow and reporting, Stephen states NASA achieved approximately a 50% efficiency gain in that process — allowing the same team to do meaningfully more with the same resources, including supporting statutory requirements such as Section 889 vendor-restriction checks.

Fourth Parties Hiding in Plain Sight

One of the more practically useful threads in the conversation concerns fourth party risk — specifically, infrastructure-level products that would never appear on a typical "critical fourth party" register, because they're not a named subcontractor providing an obvious critical service. MoveIt and CrowdStrike are both good examples: neither would naturally show up if you asked a third party "who are your critical subcontractors?" — yet both created genuine, fast-moving exposure. Stephen's argument is that mapping every fourth party exhaustively is neither realistic nor the point; what matters is the ability to rapidly answer "am I exposed to this?" when an infrastructure-level event breaks, using technical and open-source signals rather than relying solely on what a supplier volunteers.

Detection, Response Time, and the Limits of Prevention

Asked directly whether solutions like BitSight can prevent cyberattacks, Stephen is candid: "no one can prevent an attack." The realistic goal is reducing time to detect and respond, and shrinking the attack surface before an incident occurs — for example, identifying six specific issues during a vendor's onboarding due diligence and getting them resolved before data sharing begins, or catching malware beaconing on a system before it escalates into a full ransomware event. None of this proves a prevented attack, but it demonstrably reduces the scope and cost of the ones that do occur.

Regulation Is Starting to Have Teeth

Looking at the regulatory direction of travel — DORA in EU financial services, NIS2 more broadly across the EU — Stephen highlights Belgium's Centre for Cybersecurity (CCB) as an instructive early model: a government body directly monitoring critical national infrastructure organisations for vulnerabilities and proactively notifying them, having been among the first EU countries to transpose NIS2 into domestic law via its "Cyber Fundamental Assessments" programme. His broader observation: known, previously-disclosed vulnerabilities — not exotic zero-days — accounted for the large majority of attacks referenced in the reporting he opened the conversation with. Yet BitSight's own analysis found it takes roughly six months, on average, for half of known exploited vulnerabilities (the US CISA's "KEV" list) to be remediated across the organisations and geographies studied.

What Makes These Programmes Succeed or Fail

Asked for lessons learned, Stephen's answer is organisational rather than technical: buying monitoring software is the easy part. Programmes fail when the capability sits in a single, isolated team with no established path to procurement, legal or the relationship managers who actually own the connection to each third party — meaning an alert about a vulnerability has nowhere productive to go. Programmes succeed when those functions are deliberately brought together (Stephen describes running workshops where stakeholders from different parts of an organisation meet each other, in some cases, for the first time) and there's a clear, cross-functional process for escalating and acting on what the monitoring surfaces.

His practical starting advice for any TPRM team considering this shift: define the specific goal and risk appetite first, start with a realistic, bounded scope rather than an all-encompassing "big bang" programme, secure an early quick win to build organisational momentum, and only then scale the approach outward.

Listen to the full episode of Third Party Therapy on Apple Podcasts, Spotify, Amazon Music, Audacy and YouTube, or visit thirdpartytherapy.com to subscribe to the mailing list.

Tags

#ThirdPartyTherapy #TPRM #CyberSecurity #CyberRiskManagement #ContinuousMonitoring #VendorRiskManagement #FourthPartyRisk #ThirdPartyRiskManagement #DORA #NIS2 #CyberDueDiligence #SupplyChainSecurity #KnownExploitedVulnerabilities #RiskManagementPodcast #HowToMonitorThirdPartyCyberRisk #WhatIsContinuousCyberMonitoring #TPRMPodcast

The Startup's-Eye View of TPRM: Why Your Due Diligence Process Might Be Costing You the Best Suppliers

Mon, 14 Sep 2026 21:50:35 GMT

Third Party Therapy Podcast — featuring Ian Ellis, emerging technology adviser and angel investor

Most third party risk management (TPRM) conversations look at supplier onboarding from one direction: the corporate's. In this episode of Third Party Therapy, host Mike Day flips the lens, speaking with Ian Ellis — who has spent years working with emerging tech companies across banking, insurance and Microsoft's startup accelerator programme, and who now also invests in early-stage companies as an angel investor — about what a standard corporate due diligence process actually looks and feels like from the other side of the table.

Why a "Small" Delay Can Be an Existential Risk for a Startup

Ian's central concept is burn rate: the runway a startup has before it runs out of cash. What looks like a minor administrative delay to a large organisation's procurement or TPRM team — a questionnaire that takes an extra few weeks to process, a contract stuck in redlining — can push a deal past a funding quarter for the company on the other side. That matters far more than it sounds: investors judge companies against growth benchmarks (Ian cites the well-known VC shorthand of "triple, triple, double, double" year-on-year growth), and a missed quarter caused purely by a protracted corporate process can damage a genuinely good company's valuation or its ability to raise its next funding round.

This isn't about excusing weak controls. It's a reminder that the speed and manner of a TPRM process has real commercial consequences on the other end — consequences that can, ironically, end up harming the corporate too, if a strong potential supplier is lost or degraded by the process meant to protect against risk.

Two Questions to Right-Size Your Diligence

Rather than applying a single due diligence standard to every third party regardless of size, Ian suggests corporates ask two questions:

• How strategic is this supplier to what we're doing?

• How close to the core of our business will they sit?

A supplier operating at the edge of the business carries materially different risk to one embedded in a core process — and the level of scrutiny, and the controls reasonably expected, should scale accordingly.

The Danger of "Accidental Virality"

One of the sharpest points in the conversation concerns organic, uncontrolled adoption. A small pilot with three users can, if the tool is genuinely useful, spread to hundreds or thousands across an organisation with no formal scaling decision ever taken. From a resilience perspective, this is arguably a bigger risk than a large, deliberately negotiated contract — because the corporate has quietly built dependence on a supplier whose infrastructure, support model and pricing were never designed for that scale.

Ian's advice for spotting this early: has the startup itself thought about what happens when a major client starts calling at 2am expecting enterprise-grade support? If a young company's pricing looks too good to be true for the level of service now being consumed, it probably is — because early-stage companies are, in his words, "notoriously bad at underpricing their products."

You Can't Just Run a Credit Check on a VC-Backed Startup

Traditional financial viability checks — a standard credit reference report — don't work well for venture-backed companies, whose survival depends less on current revenue than on their relationship with their investors. Ian sets out what's actually worth understanding: the fund's investment cycle and how much dry powder it has left for follow-on rounds, whether that specific investor's mandate even permits follow-on investment, and where the company sits in that classic venture portfolio pattern — roughly three failures, four or five modest outcomes, and one or two genuine successes, out of every ten investments.

His practical recommendation for organisations with the internal capability: some large investment banks sign specific NDAs with prospective suppliers to review their financials in the same depth a VC would — and, where appropriate, even help a strategically important supplier secure additional funding to ensure continuity of the service being relied upon. For most TPRM functions without that specialist skill set, Ian is candid that this is a genuinely hard gap to close.

AI Has Made It Easier to Start a Company — and Harder to Judge One

Ian offers a memorable, deliberately provocative observation: "it's never been easier to start a company, and it's never been harder to scale a company," because the sheer volume of companies now claiming AI capability has degraded the signal-to-noise ratio for anyone trying to assess the market. His challenge to innovation teams specifically: they tend to fixate on the exciting, emerging end of the market and never benchmark against mature incumbents already doing something similar — which is precisely why so many promising pilots get "skewered in procurement" once someone points out that an established player already offers the same capability.

Bring TPRM and Procurement in Early — It's a Positive Signal, Not a Blocker

Perhaps the most counterintuitive message for TPRM professionals: getting risk, procurement and governance functions involved early in a conversation with an emerging supplier is not received as friction. It signals genuine organisational commitment to the deal. Ian contrasts this with the alternative failure mode he's seen repeatedly — a senior executive (a CIO, say) meets an exciting company, generates real enthusiasm, and then nothing happens because the technical and risk assessment was never actually engaged. The result: reputational damage to the corporate, wasted hope for the supplier, and — because senior leaders rarely like delivering bad news directly — a slow, demoralising fade-out instead of a fast, honest no.

His recommended model, borrowed from a venture fund contact, is "middle out": engage someone senior enough to make a decision, but junior enough to actually have the time to make it.

On Proof of Concepts, Contracts, and Treating Suppliers With Respect

Asked about proof of concept engagements, Ian is relatively relaxed about whether they're paid or free — what matters far more is intent and pace. A slow, under-resourced PoC that drags on is worse for everyone than a fast, well-supported one. On contracting, he raises a genuine concern: many founders, especially pre-Series A, are not lawyers, and the pressure of landing a marquee client can push them into signing terms — particularly around liability and intellectual property — that a more experienced negotiator would query. His suggestion is refreshingly simple: corporates can offer guidance rather than a flat rejection when a supplier lacks a control ("you're too early for this yet, but here's what we'd want to see in 12-18 months"), turning an initial no into a longer-term, collaborative relationship.

As Ian puts it, quoting a colleague: "if the deal has been negotiated so hard, they've taken so much money off the table for the company that they can't afford to support the deal, it's not a good deal."

Where AI-Based Questionnaire Tools Cut Both Ways

The conversation also touches on a genuinely double-edged development: AI tools that help suppliers generate responses to due diligence questionnaires and RFPs automatically. Ian flags the obvious question mark over accuracy at scale — when a 300-400 question due diligence questionnaire is being answered largely by AI on the supplier side, how would a buyer know, and how much does that matter? It's a direct parallel to the "questionnaire killer" style tools discussed elsewhere on the podcast, just approached from the opposite side of the relationship, and outside the buyer's visibility or control.

What Doesn't Work: Lessons From Failed Engagements

Ian closes with hard-won observations on what goes wrong. Innovation teams sometimes fall in love with a shiny new solution without doing basic market research — Ian recounts backing a small two-person UK startup in a telemetry deal at British Airways, unaware a more mature US competitor already served other airlines in the same space, effectively boxing out the stronger option. He's also sceptical of chasing efficiency purely by cutting process duration (celebrating a due diligence cycle reduced from 365 days to 180, for instance) without first asking whether the process itself is asking the right questions at all.

His clearest, most human piece of advice concerns how relationships end. Communicating a rejection, a wind-down, or a company failure with empathy — a phone call rather than an email, early honesty rather than a slow fade — matters because "everybody wants to be treated fairly," and because the emerging company you treat well today, win or lose, may be the mature, well-funded supplier you're glad to have a relationship with in three years' time.

Listen to the full episode of Third Party Therapy on Apple Podcasts, Spotify, Amazon Music, Audacy and YouTube, or visit thirdpartytherapy.com to subscribe to the mailing list.

Tags

#ThirdPartyTherapy #TPRM #VendorRiskManagement #StartupRisk #EmergingTechnology #DueDiligence #SupplierRiskManagement #ProcurementRisk #VentureCapital #ThirdPartyRiskManagement #InnovationRisk #SupplierOnboarding #RiskManagementPodcast #HowDoesTPRMWorkWithStartups #DueDiligenceForEmergingSuppliers #TPRMPodcast

Concentration Risk: It's All About the Data

Mon, 14 Sep 2026 21:40:39 GMT

Third Party Therapy Podcast — featuring Gemma Stewart, Global Head of Vendor Management, Zurich Insurance

Concentration risk has moved from a niche corner of third party risk management (TPRM) to one of the most pressing topics on the regulatory agenda — particularly within financial services. In this episode of Third Party Therapy, host Mike Day is joined by Gemma Stewart, Global Head of Vendor Management at Zurich Insurance, to unpack how a mature TPRM function actually builds a concentration risk capability from the ground up.

What Concentration Risk Really Means

Gemma defines concentration risk simply: the risks in a supply chain where concentration could produce a loss large enough to threaten an organisation's ability to maintain core operations, financially or operationally. It's fundamentally a business resilience issue.

While geographic concentration — suppliers clustered in a single region — is usually the first type organisations tackle (accelerated in recent years by geopolitical shocks), Gemma sets out five recognised categories:

• Geographic concentration — supplier or service delivery clustered in one location

• Service dependency — over-reliance on a single third party for a critical business process

• Reverse concentration — where your organisation represents such a large share of a supplier's revenue that withdrawing your contract could threaten their survival

• Fourth party concentration — hidden dependency on the same subcontractor across multiple of your third parties

• Spend concentration — the proportion of overall spend sitting with a single supplier

Reverse concentration risk is, in Mike's view, one of the most overlooked categories — partly because it typically requires financial statements that can be 12-18 months out of date by the time they're reviewed.

It Starts — and Ends — With Data

The recurring theme of this conversation is that concentration risk is, above all, a data problem. Gemma describes how, in the past, understanding Zurich's exposure to a single event could take weeks or even months simply to locate the relevant information. The starting point was building a global inventory capturing service location, data location, and the recognition that a supplier's contracted location and its actual service delivery location are very often different.

The payoff was tangible: when the Ukraine conflict began, Zurich's team could identify every third party providing services from the affected region "literally within a few minutes" — because the underlying data had already been gathered and structured. From there, the team could assess which of those services were genuinely critical, contact the relevant suppliers to check business continuity plans, and determine whether services could realistically be relocated.

For historical contracts where this data hadn't been captured up front, Zurich used AI to read existing contracts and extract the relevant fields — cutting what would otherwise have been at least a 12-month manual exercise. New contracts now capture this information at the point of due diligence, and ongoing assurance reviews (typically annual, for critical suppliers) proactively ask whether service or data locations — or fourth parties — have changed.

Fourth Parties: Proportionate, Not Exhaustive

Zurich doesn't attempt to map fourth parties across its entire supplier base. The focus is deliberately narrow: high and medium risk-tier third parties are asked about their own critical subcontractors — not, for example, their postal services provider. As Gemma puts it, the team focuses "on the ones that we're actually going to do something about."

Visualising Risk Without Drowning in It

Zurich pushes its concentration data into Power BI, building maps with filters by service type, viewable at global, regional and country level. Gemma notes that a global aggregate view "tends to dilute the picture too much" — the more useful granularity sits at the regional or country level, cross-referenced against service criticality.

Notably, Zurich has deliberately chosen not to set a fixed numerical threshold (e.g. "five critical services in one location triggers a review"), because risk appetite varies too much country to country. Instead, each flagged concentration is investigated directly with the supplier to understand what continuity and resilience measures already exist before deciding whether action is warranted. Gemma suggests this could evolve over time as the organisation matures and identifies clearer trends, but for now, deliberately keeps it open.

Impact and Likelihood — Not Just a Map

Mike draws out an important framing: mapping alone only tells you the impact side of the risk equation. The likelihood side — a supplier's financial strength, their ability to substitute a failed process, geopolitical trajectory, disaster-proneness — still requires deliberate scenario testing. Gemma agrees, and highlights simple scenario walkthroughs ("what actually happens if this takes place?") as a lightweight but effective technique, alongside more structured nine-box risk grids common in insurance.

A Cautionary Tale: Data Without Context Is Dangerous

Gemma shares a candid example of what happens when this goes wrong. One country team, having just gained access to location data, became "very overexcited" and spent around four months pulling apart contracts — moving services, changing suppliers, even terminating contracts early — based purely on geographic location data, without cross-referencing service criticality or existing business continuity arrangements, and without first speaking to the suppliers involved. The result: significant wasted effort, and damaged long-standing supplier relationships that the team is still repairing. The lesson: a single data point is never enough to justify action — always add context, and always talk to the third party before acting.

Fourth Parties, Cloud Concentration, and What Comes Next

The conversation turns to the elephant in the room for most organisations: cloud concentration. With the vast majority of SaaS tools sitting on a small number of hyperscale providers (AWS, Azure, Google Cloud), Mike observes that swapping providers often simply swaps one concentration risk for another. A more realistic mitigation, discussed by both Gemma and Mike, is drilling down a level further — looking at availability zones and data centre diversification within a single cloud provider, since a single zone outage is a far more plausible scenario than the wholesale failure of an entire hyperscaler.

Gemma also flags a genuinely interesting emerging model: at least one organisation she's aware of has opened up its own due diligence platform to its third parties, allowing them to conduct their own supply chain due diligence within the same shared instance — effectively extending visibility into the fourth party layer through shared infrastructure rather than duplicated effort.

Practical Advice for Getting Started

Asked how she'd start with a blank sheet of paper, Gemma is unequivocal: don't change the foundation. Get the data right first — a central inventory (whether that's a GRC platform or even a well-managed SharePoint site), gathered consistently at the point of sourcing, contracting and due diligence — and only then start layering risk lenses on top, beginning with whichever concentration type is most relevant to your organisation. As she puts it: "without that data... you're really just not going to know what's there in the first place."

Listen to the full episode of Third Party Therapy on Apple Podcasts, Spotify, Amazon Music, Audacy and YouTube, or visit thirdpartytherapy.com to subscribe to the mailing list.

Tags

#ThirdPartyTherapy #TPRM #ConcentrationRisk #VendorRiskManagement #OperationalResilience #FourthPartyRisk #DORA #CloudConcentrationRisk #SupplyChainRisk #DueDiligence #RiskManagement #FinancialServicesRegulation #ThirdPartyRiskManagement #InsuranceRisk #RiskManagementPodcast #WhatIsConcentrationRiskInTPRM #HowToManageFourthPartyRisk #TPRMPodcast

Machine Insights, Human Decisions: How AI Is Changing Third Party Risk Assessment

Mon, 14 Sep 2026 21:32:27 GMT

Third Party Therapy Podcast — featuring Aki Eldar, co-founder of Mirato

Artificial intelligence is either the biggest opportunity or the biggest risk in third party risk management (TPRM), depending on who you ask. In this episode of Third Party Therapy, host Mike Day speaks with Aki Eldar, entrepreneur and co-founder of Mirato, about where AI genuinely moves the needle in TPRM today — and where the industry needs to temper its expectations.

From Data Protection to TPRM

Aki's route into TPRM AI is not a straight line. He founded his first company, Secure Islands, in 2006, focused on classifying and protecting unstructured data — years before the concept of protecting the data itself, rather than the network perimeter, became mainstream. Secure Islands was acquired by Microsoft, and its technology now underpins what is broadly known as Microsoft's information protection capability. Five and a half years ago, Aki and co-founder Itay Hochman founded Mirato, bringing that same data and AI background to a discipline he describes as still "stuck ten years ago" — a world where workflow has been automated, but the actual work of assessment has not.

Where AI Fits Today: Subjective and Objective Data

Aki frames Mirato's value proposition around two categories of data:

• Subjective data — the evidence documents a third party supplies, sometimes running to thousands of pages, which must be manually mined for evidence against hundreds of controls.

• Objective data — external data sources (some paid, some free) that enrich and cross-check what the third party has provided.

Rather than requiring organisations to hire more assessors to increase either the volume or quality of assessment, Mirato's model trains the technology once and then scales it indefinitely — reading documents automatically, finding supporting evidence for controls, and pulling in external data sources without needing to add subject-matter experts for every domain.

The accuracy claim is notable: Aki cites Mirato's own accuracy at "a little bit more than 90%", against human assessor accuracy of around 60%. He is careful to frame this as augmentation, not replacement, of human judgement — Mirato's slogan is "machine insights, human decision."

Killing the Questionnaire

One of the more concrete products discussed is MQK — Mirato Questionnaire Killer — which flips the traditional due diligence questionnaire on its head. Instead of a vendor manually answering hundreds of questions, they upload their evidence documents and the system answers the majority of the questions automatically, based on what's actually written in that evidence. The vendor still attests to the answers, preserving accountability, and can request clarifications where needed.

Both this tool and Mirato's core control-assessment product provide a full audit trail: every finding links back to the specific document, page and highlighted paragraph that supports it.

Why Auditability Matters More in TPRM Than Almost Anywhere Else

Auditability isn't a nice-to-have here — it's existential. Aki is direct about the risk of "black box" AI in a regulated space: if you can't explain why a decision was reached, neither can the regulator, and that is simply unacceptable in most TPRM contexts. This is also Mirato's answer to one of generative AI's best-known weaknesses — hallucination and inconsistency. Because Mirato's assessments are fully explainable and evidence-linked rather than generative, Aki says the same inputs reliably produce the same outputs, run after run — something he notes is not guaranteed with off-the-shelf generative AI, and is often not true of human assessors either.

Beyond Assessment: Aggregation, Fourth Parties and Continuous Assessment

The conversation moves into territory relevant to concentration risk and extended supply chain visibility, an increasingly urgent regulatory concern under frameworks like DORA. Aki describes a "risk hunter" capability that automatically maps relationships between products, software packages, locations and departments to expose cascading and aggregation risk — including fourth parties.

He also draws a sharp and useful distinction between two terms often used interchangeably:

• Continuous monitoring — data changes continuously, but still requires a human to review it before it can be acted on.

• Continuous assessment — the system itself detects when a change crosses a meaningful threshold and alerts the organisation automatically.

Aki is candid that true predictive capability — anticipating incidents before they happen — isn't realistic yet. His view is deliberately incremental: get the assessment fast and accurate first, then build continuous assessment, and only then start thinking about prediction. "I don't believe in revolutions," he says, "I believe it's incremental."

The Risk of AI Assessing AI-Generated Data

Mike raises a sharper question: as AI-generated content proliferates, is there a risk that the data organisations feed into AI-driven assessment tools is itself increasingly AI-generated — creating a feedback loop that erodes reliability over time? Aki's answer circles back to design principles: as long as a system remains fully explainable and provides a complete audit trail, the ability to control and interrogate outputs is retained regardless of the provenance of the underlying data.

The Two Warnings for TPRM Leaders Considering AI

Asked what mistakes he's already seeing, Aki offers two clear warnings:

1. Don't try to solve everything at once. Bring value quickly with a narrow, well-defined use case, then expand — the classic minimum viable product approach.

2. Don't build AI capability in-house just because it's fashionable. TPRM, in Aki's view, is not the most strategic function in which to build proprietary AI, because the resulting models don't transfer to other parts of the business — you'd be paying, by his estimate, roughly ten times more to build and retrain a capability that specialist vendors already offer.

Practical First Steps

For any organisation starting this journey, the recommended approach is: define a specific use case with real value, define clear success metrics and KPIs, compare a small number of vendors solving a similar problem rather than chasing "best overall", start with a narrow scope (one or two risk domains, not the entire assessment), and start standalone before integrating into your broader IRM and workflow stack.

The direction of travel Aki describes mirrors the automotive industry's own evolution — from fully manual assembly to a process still run on the same workflow "assembly line," but where machines now do roughly 80% of the work, freeing people to focus on judgement rather than administration. His ambition for TPRM: flip today's roughly 80% data administration / 20% risk and mitigation split into its inverse.

Listen to the full episode of Third Party Therapy on Apple Podcasts, Spotify, Amazon Music, Audacy and YouTube, or visit thirdpartytherapy.com to subscribe to the mailing list.

Tags

#ThirdPartyTherapy #TPRM #ArtificialIntelligence #AIinTPRM #VendorRiskManagement #DueDiligence #ContinuousMonitoring #ContinuousAssessment #RegTech #ThirdPartyRisk #GenerativeAI #ExplainableAI #DORA #FourthPartyRisk #RiskManagementPodcast #HowIsAIUsedInThirdPartyRiskManagement #AIVendorDueDiligence #TPRMPodcast

What Does Community Due Diligence Actually Deliver?

Mon, 14 Sep 2026 21:22:31 GMT

Third Party Therapy Podcast — Series 1, Episode 1 — featuring Paul Huggett, Managing Director, Hellios

For the very first episode of Third Party Therapy, host Mike Day speaks with Paul Huggett, Managing Director at Hellios and a former head of third party risk management (TPRM) at Lloyds Banking Group, Bank of Ireland and Nationwide Building Society. Having sat on both sides of the fence — as a buyer of pooled due diligence for over a decade, and now as a provider of it — Paul offers a rare, grounded view of what community due diligence really delivers, and where its limits are.

From "Poacher" to "Gamekeeper" to Provider

Paul's career path is itself a neat illustration of how TPRM as a discipline emerged almost by accident. Starting in operational and IT project management in the early 1990s, he moved into outsourcing project delivery — describing himself at the time as a "poacher," someone focused purely on moving functions quickly, for whom procurement was simply an obstacle. A move into internal audit at Lloyds Banking Group — auditing the sourcing and property functions — turned him into a "gamekeeper," and from there he spent a decade running third party risk functions across three major financial institutions, all of which were customers of Hellios's FSQS scheme, before joining Hellios itself roughly 18 months ago.

Ten Years of Change in TPRM

Paul's account of how far the discipline has moved is stark. His first supplier management audit revealed that "due diligence" at the time amounted to a signed letter from the supplier saying "everything's fine, thank you." The regulatory framework consisted of a handful of bullet points essentially saying "you can't outsource the risk." The period from roughly 2015 to 2018 — driven by GDPR, the growth of cloud outsourcing, and European regulators waking up to the risk — triggered rapid change, followed by growing UK regulatory focus (SS2/21 and PS7/21) on operational resilience, conduct risk, and more recently ESG, which Paul says has moved from "almost at the bottom of the pile" to near the top of the risk league table.

What Pooled Due Diligence Actually Is

Paul's explanation is refreshingly plain: the traditional model is a "many-to-many mesh" — every buyer individually asking every one of their suppliers largely the same questions, repeatedly. Pooled or community due diligence flips this into a one-to-many model: a supplier answers a shared, standardised question set once, and that data is made available (with the supplier's consent and quality-checked) to every buyer in the community who needs it.

The win is symmetric. Suppliers spend less time repeatedly answering near-identical questionnaires from dozens of buyers. Buyers get a faster start, a broader pool of pre-assessed suppliers, and — critically — a question set that reflects a decade of collective input from the buying community, not just their own risk team's best guess. As Paul puts it, being able to tell your board "this is good enough for other FS firms, therefore we believe it's good enough for us" is valuable air cover for a new entrant to the model.

From Niche to Mainstream

When Lloyds Banking Group first adopted the model, it was the only buying firm in the community — making it a hard sell to suppliers. Today, Hellios's UK community includes just under 70 buying firms, plus roughly 20 more across Europe, spanning tiny building societies through to major international investment banks. Paul attributes the shift to sustained pressure on TPRM budgets and headcount ("you never get, as a TPRM person, someone come to you and say... would you like some more people?"), combined with a regulatory turning point around 2018-2019 when European regulation first explicitly acknowledged shared assurance as acceptable — provided the buyer using it still applies its own risk appetite to the results, rather than simply outsourcing the decision.

Confidentiality and Competition Law

Two objections come up repeatedly with pooled models, and Paul addresses both directly. On confidentiality, where a supplier is unwilling to upload a sensitive document (such as a full cybersecurity policy) directly, Hellios instead asks granular, structured yes/no questions about the specific controls contained within that document — meaning a buyer's risk specialist can still assess control coverage without the underlying document ever being shared. On competition law, Hellios never discloses which buyers work with which suppliers to other buyers in the community, never comments on individual suppliers as a collective, and never directs buyers to take action against a specific supplier — all of which would risk anti-competitive behaviour.

Not a Silver Bullet — Part of an Ecosystem

Paul is careful to position pooled due diligence as one part of a wider TPRM toolkit, not a replacement for the buyer's own risk judgement. Hellios provides primary, source-verified data (rather than scraped or blended third-party data), but the buyer still has to decide what matters to them and act on it. His framing: "we give you the information, but your job is to decide what to do with it."

Real-World Stress Testing: Russia-Ukraine

One of the clearest illustrations of the model's value came with the outbreak of the Russia-Ukraine conflict. Because Hellios already held country of registration, operating location and fourth party data for its supplier community, buyer firms could establish their exposure "within about half an hour" of the event breaking — rather than manually cross-referencing finance systems to work out who they'd been paying, and where. Hellios then issued a bespoke follow-up questionnaire to roughly 10,000 suppliers within about ten days, with an 80% response rate — giving buyers not just a static exposure map, but live intelligence on downstream impact. The same approach was repeated for the Israel-Gaza conflict and rolling energy blackouts.

Where AI Fits — and Where Hellios Is Deliberately Cautious

Asked about AI, Paul draws a pointed comparison to cloud computing circa 2017-2018: a lot of noise, real underlying risk, but limited clarity on exactly where the exposure sits. Hellios is building a new question set specifically to assess suppliers' use of AI, aligned to the EU AI Act's risk-based, proportionate approach. But Paul is candid that Hellios itself is deliberately slow to deploy AI at scale in its own data pipeline, given its core value proposition rests on primary, verified data rather than scraped or AI-generated content — and flags the emerging industry concern that large language models may increasingly be trained on data that itself originated from other AI systems, creating a quality-degradation risk over time.

Concentration Risk and the Regulator's Blind Spot

Paul also touches on Critical Third Party (CTP) regulation and the new, more detailed outsourcing and DORA registers now required by UK and EU regulators — designed to help regulators identify concentration risk across the financial sector. He's candid that Hellios, precisely because of the same competition and confidentiality constraints discussed earlier, cannot fill this gap entirely: it knows what a supplier does, but not what each buyer considers critical about that relationship, since criticality varies hugely between an insurer, a reinsurer, a building society and an investment manager.

The Direction of Travel: From Data to Assurance

Looking ahead, Paul sees the community model extending from data-gathering into genuine assurance — Hellios has already introduced ESG benchmarking that lets suppliers see how they compare to peers, and has launched pooled, supplier-funded virtual site visits testing controls across the top operational risk domains. Notably, he observes that resistance to pooled assurance has historically come more from buyers wanting to "do things their way" than from suppliers, who are generally keen to spend less time on duplicate assurance requests.

A Practical Starting Point

For any organisation considering this path, Paul's advice is to look at your own organisation from the supplier's point of view: how many different, overlapping data requests are you sending out? Are you actually using everything you collect, or gathering data you never act on? And do you genuinely understand your broader (not just your most critical) supplier population — because, as Paul notes pointedly, "Covid did not care that it was taking out your workforce from a whole swathe of your medium risk suppliers."

His clearest warning, drawn from watching organisations invest heavily in shiny new source-to-pay platforms: the technology is rarely the problem. "Systems and technology are not going to solve your problems. They're just going to give you a shinier problem to grapple with," unless matched with the cultural change and data discipline to actually populate and use them.

Listen to the full episode of Third Party Therapy, produced in association with CeFPro, on Apple Podcasts, Spotify, Amazon Music, Audacy and YouTube, or visit thirdpartytherapy.com to subscribe to the mailing list.

Tags

#ThirdPartyTherapy #TPRM #CommunityDueDiligence #PooledDueDiligence #VendorRiskManagement #ThirdPartyRiskManagement #FSQS #SharedAssurance #DueDiligence #FinancialServicesRegulation #ConcentrationRisk #CriticalThirdParty #DORA #SupplierRiskManagement #RiskManagementPodcast #WhatIsPooledDueDiligence #HowDoesCommunityDueDiligenceWork #TPRMPodcast

Modern Slavery in Your Supply Chain: Why Box-Ticking Won't Protect Your Third Parties (or Their Victims)

Mon, 14 Sep 2026 21:22:21 GMT

Third Party Therapy Podcast — featuring Shayne Tyler, supply chain modern slavery expert

Modern slavery rarely makes the same headlines as a cyber breach or a data leak, yet its human cost is far greater — and, as this episode of Third Party Therapy makes clear, it is far closer to the corporate world than most third party risk management (TPRM) professionals assume.

Host Mike Day sat down with Shayne Tyler, a supply chain modern slavery expert with over 20 years of first-hand experience tackling worker exploitation. Shayne's involvement in this space began in the most direct way possible: as an operations manager whose own factory was exposed on the BBC's Panorama in 2000 for the illegal employment of more than 200 staff. That experience — engaging afterwards with the victims themselves — set the course for the rest of his career.

What Modern Slavery Actually Is

Shayne's central message is that "modern slavery" is a broad umbrella covering forced labour, organ harvesting, forced criminality and prostitution, but that in the corporate world, forced labour driven by human trafficking dominates. Crucially, he stresses that human trafficking does not require crossing a border: moving someone from one field, or one office, to another for the purpose of exploitation is enough.

He breaks trafficking down into three legal components that must all be present:

• Action — the transportation, harbouring or receipt of a person

• Means — control and power exercised over them

• Purpose — for financial gain

Without all three, it is a different crime entirely — smuggling, or extortion. That distinction is part of why modern slavery is so notoriously difficult to prosecute: the "chains" are usually psychological, built through debt, fear, pride or hope rather than physical restraint.

The UK Is Not Immune — and Neither Is Finance

A common assumption in TPRM circles is that modern slavery is confined to agriculture, food production or other manual, low-skill sectors overseas. Shayne dismantles this. Citing Pew Research Centre estimates of 800,000 to 1.2 million people in the UK without the right to live and work — roughly one in fifty people — he argues that any organisation interacting with more than fifty people is statistically likely to encounter someone in that position.

He points to worker substitution (the person who turns up to do the job is not the person who was vetted) as a pervasive and largely unpoliced gap, and highlights how visa routes — Tier 2 skilled worker sponsorship, the Tier 5 seasonal worker scheme, EU Settled Status, and student visas — all carry their own distinct exploitation risks, from debt bondage arranged in the worker's home country to fee-payment scams tied to fraudulent immigration paperwork.

For financial services specifically, Shayne draws a direct parallel to anti-money laundering controls: a pattern such as a victim's bank account being emptied every Friday night at a cash point is exactly the kind of anomaly that existing AML infrastructure could be adapted to flag — if TPRM, fraud and financial crime teams collaborated on it.

Why Policies Don't Stop Exploiters — Processes Do

Perhaps the sharpest insight in the episode: in 24 years of this work, Shayne says he has "not met an exploiter yet that has cared one iota about a company's policy." Exploiters study and infiltrate processes, not statements. His own audits have generated close to 30 critical non-compliances in a single afternoon by testing a labour provider's systems with deliberately falsified information — precisely the same technique an exploiter would use.

This is a direct challenge to the "modern slavery statement" as a compliance artefact. As he puts it, no statement has ever prevented a victim.

The Four Ps: A Practical Due Diligence Framework

Rather than defaulting to a checklist, Shayne recommends corporates adopt a four-stage approach:

1. Pursue — assume exploitation is present in your supply chain and actively look for it, rather than assuming the absence of evidence means the absence of a problem.

2. Prevent — use what you find to close gaps for the next case, even if you can't undo the last one.

3. Prepare — share learnings across your business, supply chain and even competitors, and train staff to recognise the signs.

4. Protect — not only the victim, but the brand, the business, the systems and the staff. Protecting everyone matters, because "there is no point in being the most ethical business on the planet if you're out of business."

Look for the Absence of Normal, Not the Presence of Abnormal

One of the episode's most striking reframes: conventional guidance tells people to look for visible signs of exploitation (houses of multiple occupancy, signs of abuse, isolation). But if a sign is visible, Shayne argues, exploiters already know to hide it. The more reliable indicator is the absence of normal — the person who never mentions weekend plans, who never has an ordinary conversation about ordinary life.

And when a potential victim is identified, the instinct to escalate immediately can be dangerous. Shayne recounts a case in which acting too fast caused 53 people connected to a single victim to disappear. His guidance: de-escalate, gather information quietly, and hand a complete picture to the authorities rather than attempting to investigate or "rescue" directly.

The Takeaway for TPRM Teams

This conversation is a reminder that third party risk management's toolkit — due diligence, escalation, ongoing monitoring — has direct relevance to one of the most serious human rights issues in modern business, but only if it moves beyond box-ticking. Real progress means testing processes the way an exploiter would, watching for the absence of the ordinary, and building cross-functional collaboration between TPRM, procurement, HR and financial crime teams.

As Shayne puts it, using a health and safety analogy: don't jump straight to the high-vis vest. Eliminate the risk first, substitute it, segregate it, administrate it — and only then rely on the last line of defence.

Listen to the full episode of Third Party Therapy on Apple Podcasts, Spotify, Amazon Music, Audacy and YouTube, or visit thirdpartytherapy.com to subscribe to the mailing list.

Tags

#ThirdPartyTherapy #TPRM #ModernSlavery #SupplyChainRisk #HumanTrafficking #VendorRiskManagement #DueDiligence #ForcedLabour #EthicalSupplyChain #ESG #FinancialServicesRegulation #SupplierRisk #CorporateResponsibility #RiskManagementPodcast #ModernSlaveryAct #WhatIsModernSlaveryInTheSupplyChain #HowToSpotModernSlaveryInBusiness #TPRMPodcast