The Startup's-Eye View of TPRM: Why Your Due Diligence Process Might Be Costing You the Best Suppliers

Mike Day • 14 September 2026

Third Party Therapy Podcast — featuring Ian Ellis, emerging technology adviser and angel investor

Most third party risk management (TPRM) conversations look at supplier onboarding from one direction: the corporate's. In this episode of Third Party Therapy, host Mike Day flips the lens, speaking with Ian Ellis — who has spent years working with emerging tech companies across banking, insurance and Microsoft's startup accelerator programme, and who now also invests in early-stage companies as an angel investor — about what a standard corporate due diligence process actually looks and feels like from the other side of the table.

Why a "Small" Delay Can Be an Existential Risk for a Startup

Ian's central concept is burn rate: the runway a startup has before it runs out of cash. What looks like a minor administrative delay to a large organisation's procurement or TPRM team — a questionnaire that takes an extra few weeks to process, a contract stuck in redlining — can push a deal past a funding quarter for the company on the other side. That matters far more than it sounds: investors judge companies against growth benchmarks (Ian cites the well-known VC shorthand of "triple, triple, double, double" year-on-year growth), and a missed quarter caused purely by a protracted corporate process can damage a genuinely good company's valuation or its ability to raise its next funding round.

This isn't about excusing weak controls. It's a reminder that the speed and manner of a TPRM process has real commercial consequences on the other end — consequences that can, ironically, end up harming the corporate too, if a strong potential supplier is lost or degraded by the process meant to protect against risk.

Two Questions to Right-Size Your Diligence

Rather than applying a single due diligence standard to every third party regardless of size, Ian suggests corporates ask two questions:

•     How strategic is this supplier to what we're doing?

•     How close to the core of our business will they sit?

A supplier operating at the edge of the business carries materially different risk to one embedded in a core process — and the level of scrutiny, and the controls reasonably expected, should scale accordingly.

The Danger of "Accidental Virality"

One of the sharpest points in the conversation concerns organic, uncontrolled adoption. A small pilot with three users can, if the tool is genuinely useful, spread to hundreds or thousands across an organisation with no formal scaling decision ever taken. From a resilience perspective, this is arguably a bigger risk than a large, deliberately negotiated contract — because the corporate has quietly built dependence on a supplier whose infrastructure, support model and pricing were never designed for that scale.

Ian's advice for spotting this early: has the startup itself thought about what happens when a major client starts calling at 2am expecting enterprise-grade support? If a young company's pricing looks too good to be true for the level of service now being consumed, it probably is — because early-stage companies are, in his words, "notoriously bad at underpricing their products."

You Can't Just Run a Credit Check on a VC-Backed Startup

Traditional financial viability checks — a standard credit reference report — don't work well for venture-backed companies, whose survival depends less on current revenue than on their relationship with their investors. Ian sets out what's actually worth understanding: the fund's investment cycle and how much dry powder it has left for follow-on rounds, whether that specific investor's mandate even permits follow-on investment, and where the company sits in that classic venture portfolio pattern — roughly three failures, four or five modest outcomes, and one or two genuine successes, out of every ten investments.

His practical recommendation for organisations with the internal capability: some large investment banks sign specific NDAs with prospective suppliers to review their financials in the same depth a VC would — and, where appropriate, even help a strategically important supplier secure additional funding to ensure continuity of the service being relied upon. For most TPRM functions without that specialist skill set, Ian is candid that this is a genuinely hard gap to close.

AI Has Made It Easier to Start a Company — and Harder to Judge One

Ian offers a memorable, deliberately provocative observation: "it's never been easier to start a company, and I don't think this is probably going to be a little controversial — it's never been harder to scale a company," because the sheer volume of companies now claiming AI capability has degraded the signal-to-noise ratio for anyone trying to assess the market. His challenge to innovation teams specifically: they tend to fixate on the exciting, emerging end of the market and never benchmark against mature incumbents already doing something similar — which is precisely why so many promising pilots get "skewered in procurement" once someone points out that an established player already offers the same capability.

Bring TPRM and Procurement in Early — It's a Positive Signal, Not a Blocker

Perhaps the most counterintuitive message for TPRM professionals: getting risk, procurement and governance functions involved early in a conversation with an emerging supplier is not received as friction. It signals genuine organisational commitment to the deal. Ian contrasts this with the alternative failure mode he's seen repeatedly — a senior executive (a CIO, say) meets an exciting company, generates real enthusiasm, and then nothing happens because the technical and risk assessment was never actually engaged. The result: reputational damage to the corporate, wasted hope for the supplier, and — because senior leaders rarely like delivering bad news directly — a slow, demoralising fade-out instead of a fast, honest no.

His recommended model, borrowed from a venture fund contact, is "middle out": engage someone senior enough to make a decision, but junior enough to actually have the time to make it.

On Proof of Concepts, Contracts, and Treating Suppliers With Respect

Asked about proof of concept engagements, Ian is relatively relaxed about whether they're paid or free — what matters far more is intent and pace. A slow, under-resourced PoC that drags on is worse for everyone than a fast, well-supported one. On contracting, he raises a genuine concern: many founders, especially pre-Series A, are not lawyers, and the pressure of landing a marquee client can push them into signing terms — particularly around liability and intellectual property — that a more experienced negotiator would query. His suggestion is refreshingly simple: corporates can offer guidance rather than a flat rejection when a supplier lacks a control ("you're too early for this yet, but here's what we'd want to see in 12-18 months"), turning an initial no into a longer-term, collaborative relationship.

As Ian puts it, quoting a colleague: "if the deal has been negotiated so hard, they've taken so much money off the table for the company that they can't afford to support the deal, it's not a good deal."

Where AI-Based Questionnaire Tools Cut Both Ways

The conversation also touches on a genuinely double-edged development: AI tools that help suppliers generate responses to due diligence questionnaires and RFPs automatically. Ian flags the obvious question mark over accuracy at scale — when a 300-400 question due diligence questionnaire is being answered largely by AI on the supplier side, how would a buyer know, and how much does that matter? It's a direct parallel to the "questionnaire killer" style tools discussed elsewhere on the podcast, just approached from the opposite side of the relationship, and outside the buyer's visibility or control.

What Doesn't Work: Lessons From Failed Engagements

Ian closes with hard-won observations on what goes wrong. Innovation teams sometimes fall in love with a shiny new solution without doing basic market research — Ian recounts backing a small two-person UK startup in a telemetry deal at British Airways, unaware a more mature US competitor already served other airlines in the same space, effectively boxing out the stronger option. He's also sceptical of chasing efficiency purely by cutting process duration (celebrating a due diligence cycle reduced from 365 days to 180, for instance) without first asking whether the process itself is asking the right questions at all.

His clearest, most human piece of advice concerns how relationships end. Communicating a rejection, a wind-down, or a company failure with empathy — a phone call rather than an email, early honesty rather than a slow fade — matters because "everybody wants to be treated fairly," and because the emerging company you treat well today, win or lose, may be the mature, well-funded supplier you're glad to have a relationship with in three years' time.


Listen to the full episode of Third Party Therapy, produced in association with CeFPro, on Apple Podcasts, Spotify, Amazon Music, Audacy and YouTube, or visit thirdpartytherapy.com to subscribe to the mailing list.


Tags

#ThirdPartyTherapy #TPRM #VendorRiskManagement #StartupRisk #EmergingTechnology #DueDiligence #SupplierRiskManagement #ProcurementRisk #VentureCapital #ThirdPartyRiskManagement #InnovationRisk #SupplierOnboarding #RiskManagementPodcast #HowDoesTPRMWorkWithStartups #DueDiligenceForEmergingSuppliers #TPRMPodcast

From Annual Assessment to Continuous Monitoring: Rethinking Cyber Risk in Your Supply Chain

by Mike Day • 14 September 2026
Third Party Therapy Podcast — featuring Stephen Boyer, Co-Founder and Chief Innovation Officer, BitSight

Concentration Risk: It's All About the Data

by Mike Day • 14 September 2026
Third Party Therapy Podcast — featuring Gemma Stewart, Global Head of Vendor Management, Zurich Insurance

Machine Insights, Human Decisions: How AI Is Changing Third Party Risk Assessment

by Mike Day • 14 September 2026
Third Party Therapy Podcast — featuring Aki Eldar, co-founder of Mirato

What Does Community Due Diligence Actually Deliver?

by Mike Day • 14 September 2026
Third Party Therapy Podcast — Series 1, Episode 1 — featuring Paul Huggett, Managing Director, Helios For the very first episode of Third Party Therapy, host Mike Day speaks with Paul Huggett, Managing Director at Helios and a former head of third party risk management (TPRM) at Lloyds Banking Group, Bank of Ireland and Nationwide Building Society. Having sat on both sides of the fence — as a buyer of pooled due diligence for over a decade, and now as a provider of it — Paul offers a rare, grounded view of what community due diligence really delivers, and where its limits are. From "Poacher" to "Gamekeeper" to Provider Paul's career path is itself a neat illustration of how TPRM as a discipline emerged almost by accident. Starting in operational and IT project management in the early 1990s, he moved into outsourcing project delivery — describing himself at the time as a "poacher," someone focused purely on moving functions quickly, for whom procurement was simply an obstacle. A move into internal audit at Lloyds Banking Group — auditing the sourcing and property functions — turned him into a "gamekeeper," and from there he spent a decade running third party risk functions across three major financial institutions, all of which were customers of Helios's FSQS scheme, before joining Helios itself roughly 18 months ago. Ten Years of Change in TPRM Paul's account of how far the discipline has moved is stark. His first supplier management audit revealed that "due diligence" at the time amounted to a signed letter from the supplier saying "everything's fine, thank you." The regulatory framework consisted of a handful of bullet points essentially saying "you can't outsource the risk." The period from roughly 2015 to 2018 — driven by GDPR, the growth of cloud outsourcing, and European regulators waking up to the risk — triggered rapid change, followed by growing UK regulatory focus (SS2/21 and PS7/21) on operational resilience, conduct risk, and more recently ESG, which Paul says has moved from "almost at the bottom of the pile" to near the top of the risk league table. What Pooled Due Diligence Actually Is Paul's explanation is refreshingly plain: the traditional model is a "many-to-many mesh" — every buyer individually asking every one of their suppliers largely the same questions, repeatedly. Pooled or community due diligence flips this into a one-to-many model: a supplier answers a shared, standardised question set once, and that data is made available (with the supplier's consent and quality-checked) to every buyer in the community who needs it. The win is symmetric. Suppliers spend less time repeatedly answering near-identical questionnaires from dozens of buyers. Buyers get a faster start, a broader pool of pre-assessed suppliers, and — critically — a question set that reflects a decade of collective input from the buying community, not just their own risk team's best guess. As Paul puts it, being able to tell your board "this is good enough for [named peer firms], therefore we believe it's good enough for us" is valuable air cover for a new entrant to the model. From Niche to Mainstream When Lloyds Banking Group first adopted the model, it was the only buying firm in the community — making it a hard sell to suppliers. Today, Helios's UK community includes just under 70 buying firms, plus roughly 20 more across Europe, spanning tiny building societies through to major international investment banks. Paul attributes the shift to sustained pressure on TPRM budgets and headcount ("you never get, as a TPR person, someone come to you and say... would you like some more people?"), combined with a regulatory turning point around 2018-2019 when European regulation first explicitly acknowledged shared assurance as acceptable — provided the buyer using it still applies its own risk appetite to the results, rather than simply outsourcing the decision. Confidentiality and Competition Law Two objections come up repeatedly with pooled models, and Paul addresses both directly. On confidentiality, where a supplier is unwilling to upload a sensitive document (such as a full cybersecurity policy) directly, Helios instead asks granular, structured yes/no questions about the specific controls contained within that document — meaning a buyer's risk specialist can still assess control coverage without the underlying document ever being shared. On competition law, Helios never discloses which buyers work with which suppliers to other buyers in the community, never comments on individual suppliers as a collective, and never directs buyers to take action against a specific supplier — all of which would risk anti-competitive behaviour. Not a Silver Bullet — Part of an Ecosystem Paul is careful to position pooled due diligence as one part of a wider TPRM toolkit, not a replacement for the buyer's own risk judgement. Helios provides primary, source-verified data (rather than scraped or blended third-party data), but the buyer still has to decide what matters to them and act on it. His framing: "we give you the information, but your job is to decide what to do with it." Real-World Stress Testing: Russia-Ukraine One of the clearest illustrations of the model's value came with the outbreak of the Russia-Ukraine conflict. Because Helios already held country of registration, operating location and fourth party data for its supplier community, buyer firms could establish their exposure "within about half an hour" of the event breaking — rather than manually cross-referencing finance systems to work out who they'd been paying, and where. Helios then issued a bespoke follow-up questionnaire to roughly 10,000 suppliers within about ten days, with an 80% response rate — giving buyers not just a static exposure map, but live intelligence on downstream impact. The same approach was repeated for the Israel-Gaza conflict and rolling energy blackouts. Where AI Fits — and Where Helios Is Deliberately Cautious Asked about AI, Paul draws a pointed comparison to cloud computing circa 2017-2018: a lot of noise, real underlying risk, but limited clarity on exactly where the exposure sits. Helios is building a new question set specifically to assess suppliers' use of AI, aligned to the EU AI Act's risk-based, proportionate approach. But Paul is candid that Helios itself is deliberately slow to deploy AI at scale in its own data pipeline, given its core value proposition rests on primary, verified data rather than scraped or AI-generated content — and flags the emerging industry concern that large language models may increasingly be trained on data that itself originated from other AI systems, creating a quality-degradation risk over time. Editorial note: the discussion of AI training data and model quality reflects Paul Huggett's own views and industry commentary referenced on the podcast, not an independently verified technical claim. Concentration Risk and the Regulator's Blind Spot Paul also touches on Critical Third Party (CTP) regulation and the new, more detailed outsourcing and DORA registers now required by UK and EU regulators — designed to help regulators identify concentration risk across the financial sector. He's candid that Helios, precisely because of the same competition and confidentiality constraints discussed earlier, cannot fill this gap entirely: it knows what a supplier does, but not what each buyer considers critical about that relationship, since criticality varies hugely between an insurer, a reinsurer, a building society and an investment manager. The Direction of Travel: From Data to Assurance Looking ahead, Paul sees the community model extending from data-gathering into genuine assurance — Helios has already introduced ESG benchmarking that lets suppliers see how they compare to peers, and has launched pooled, supplier-funded virtual site visits testing controls across the top operational risk domains. Notably, he observes that resistance to pooled assurance has historically come more from buyers wanting to "do things their way" than from suppliers, who are generally keen to spend less time on duplicate assurance requests. A Practical Starting Point For any organisation considering this path, Paul's advice is to look at your own organisation from the supplier's point of view: how many different, overlapping data requests are you sending out? Are you actually using everything you collect, or gathering data you never act on? And do you genuinely understand your broader (not just your most critical) supplier population — because, as Paul notes pointedly, "Covid did not care that it was taking out your workforce from a whole swathe of your medium risk suppliers." His clearest warning, drawn from watching organisations invest heavily in shiny new source-to-pay platforms: the technology is rarely the problem. "Systems and technology are not going to solve your problems. They're just going to give you a shinier problem to grapple with," unless matched with the cultural change and data discipline to actually populate and use them. Listen to the full episode of Third Party Therapy, produced in association with CeFPro, on Apple Podcasts, Spotify, Amazon Music, Audacy and YouTube, or visit thirdpartytherapy.com to subscribe to the mailing list. Tags #ThirdPartyTherapy #TPRM #CommunityDueDiligence #PooledDueDiligence #VendorRiskManagement #ThirdPartyRiskManagement #FSQS #SharedAssurance #DueDiligence #FinancialServicesRegulation #ConcentrationRisk #CriticalThirdParty #DORA #SupplierRiskManagement #RiskManagementPodcast #WhatIsPooledDueDiligence #HowDoesCommunityDueDiligenceWork #TPRMPodcast

Modern Slavery in Your Supply Chain: Why Box-Ticking Won't Protect Your Third Parties (or Their Victims)

by Mike Day • 14 September 2026
Third Party Therapy Podcast — featuring Shayne Tyler, supply chain modern slavery expert Modern slavery rarely makes the same headlines as a cyber breach or a data leak, yet its human cost is far greater — and, as this episode of Third Party Therapy makes clear, it is far closer to the corporate world than most third party risk management (TPRM) professionals assume. Host Mike Day sat down with Shayne Tyler, a supply chain modern slavery expert with over 20 years of first-hand experience tackling worker exploitation. Shayne's involvement in this space began in the most direct way possible: as an operations manager whose own factory was exposed on the BBC's Panorama in 2000 for the illegal employment of more than 200 staff. That experience — engaging afterwards with the victims themselves — set the course for the rest of his career. What Modern Slavery Actually Is Shayne's central message is that "modern slavery" is a broad umbrella covering forced labour, organ harvesting, forced criminality and prostitution, but that in the corporate world, forced labour driven by human trafficking dominates. Crucially, he stresses that human trafficking does not require crossing a border: moving someone from one field, or one office, to another for the purpose of exploitation is enough. He breaks trafficking down into three legal components that must all be present: • Action — the transportation, harbouring or receipt of a person • Means — control and power exercised over them • Purpose — for financial gain Without all three, it is a different crime entirely — smuggling, or extortion. That distinction is part of why modern slavery is so notoriously difficult to prosecute: the "chains" are usually psychological, built through debt, fear, pride or hope rather than physical restraint. The UK Is Not Immune — and Neither Is Finance A common assumption in TPRM circles is that modern slavery is confined to agriculture, food production or other manual, low-skill sectors overseas. Shayne dismantles this. Citing Pew Research Centre estimates of 800,000 to 1.2 million people in the UK without the right to live and work — roughly one in fifty people — he argues that any organisation interacting with more than fifty people is statistically likely to encounter someone in that position. He points to worker substitution (the person who turns up to do the job is not the person who was vetted) as a pervasive and largely unpoliced gap, and highlights how visa routes — Tier 2 skilled worker sponsorship, the Tier 5 seasonal worker scheme, EU Settled Status, and student visas — all carry their own distinct exploitation risks, from debt bondage arranged in the worker's home country to fee-payment scams tied to fraudulent immigration paperwork. For financial services specifically, Shayne draws a direct parallel to anti-money laundering controls: a pattern such as a victim's bank account being emptied every Friday night at a cash point is exactly the kind of anomaly that existing AML infrastructure could be adapted to flag — if TPRM, fraud and financial crime teams collaborated on it. Why Policies Don't Stop Exploiters — Processes Do Perhaps the sharpest insight in the episode: in 24 years of this work, Shayne says he has "not met an exploiter yet that has cared one iota about a company's policy." Exploiters study and infiltrate processes, not statements. His own audits have generated close to 30 critical non-compliances in a single afternoon by testing a labour provider's systems with deliberately falsified information — precisely the same technique an exploiter would use. This is a direct challenge to the "modern slavery statement" as a compliance artefact. As he puts it, no statement has ever prevented a victim. The Four Ps: A Practical Due Diligence Framework Rather than defaulting to a checklist, Shayne recommends corporates adopt a four-stage approach: 1. Pursue — assume exploitation is present in your supply chain and actively look for it, rather than assuming the absence of evidence means the absence of a problem. 2. Prevent — use what you find to close gaps for the next case, even if you can't undo the last one. 3. Prepare — share learnings across your business, supply chain and even competitors, and train staff to recognise the signs. 4. Protect — not only the victim, but the brand, the business, the systems and the staff. Protecting everyone matters, because "there is no point in being the most ethical business on the planet if you're out of business." Look for the Absence of Normal, Not the Presence of Abnormal One of the episode's most striking reframes: conventional guidance tells people to look for visible signs of exploitation (houses of multiple occupancy, signs of abuse, isolation). But if a sign is visible, Shayne argues, exploiters already know to hide it. The more reliable indicator is the absence of normal — the person who never mentions weekend plans, who never has an ordinary conversation about ordinary life. And when a potential victim is identified, the instinct to escalate immediately can be dangerous. Shayne recounts a case in which acting too fast caused 53 people connected to a single victim to disappear. His guidance: de-escalate, gather information quietly, and hand a complete picture to the authorities rather than attempting to investigate or "rescue" directly. The Takeaway for TPRM Teams This conversation is a reminder that third party risk management's toolkit — due diligence, escalation, ongoing monitoring — has direct relevance to one of the most serious human rights issues in modern business, but only if it moves beyond box-ticking. Real progress means testing processes the way an exploiter would, watching for the absence of the ordinary, and building cross-functional collaboration between TPRM, procurement, HR and financial crime teams. As Shayne puts it, using a health and safety analogy: don't jump straight to the high-vis vest. Eliminate the risk first, substitute it, segregate it, administrate it — and only then rely on the last line of defence. Listen to the full episode of Third Party Therapy on Apple Podcasts, Spotify, Amazon Music, Audacy and YouTube, or visit thirdpartytherapy.com to subscribe to the mailing list. Tags #ThirdPartyTherapy #TPRM #ModernSlavery #SupplyChainRisk #HumanTrafficking #VendorRiskManagement #DueDiligence #ForcedLabour #EthicalSupplyChain #ESG #FinancialServicesRegulation #SupplierRisk #CorporateResponsibility #RiskManagementPodcast #ModernSlaveryAct #WhatIsModernSlaveryInTheSupplyChain #HowToSpotModernSlaveryInBusiness #TPRMPodcast