Contracts bring risk appetite, business expectations, and third party responsibilities together. But when an incident occurs, performance falls short, or a relationship ends, will the agreement provide the clarity your organization needs? In this episode, host Hilary Jewhurst joins Chris Phillips, VP, Procurement & Vendor Risk at Lendmark Financial Services, for a practical conversation about strengthening vendor contracts and making accountability part of everyday relationship management. “You're not here to hinder them. You're here to help them.” — Chris Phillips Drawing on his experience overseeing procurement and vendor risk, Chris shares how early collaboration, clear internal processes, and a risk-based approach can help teams negotiate stronger agreements and manage obligations beyond signature. Five topics to listen for: Plan your exit before you sign. Address data return requirements, timelines, and formats upfront to reduce confusion when a relationship ends. Make accountability measurable. Define what the third party must do, when it must act, how performance will be measured, what evidence is required, and what happens when expectations are not met. Revisit contracts as risks change. Consider whether vendor AI adoption, incidents, performance issues, or changes in services create gaps in existing agreements. Know when to escalate. When a vendor will not accept contract changes, identify the missing protections and route risk acceptance to the appropriate decision-makers. Protect your negotiating leverage. Engage procurement, TPRM, legal, information security, and business owners early. Prioritize critical vendors and allow time for reviews, negotiations, and evaluating alternatives. Key Takeaway: A contract supports accountability when its obligations are clear, owned, and actively managed. Start with your critical vendors, strengthen internal collaboration, and use ongoing reviews to keep agreements aligned with the relationship’s risks. Watch this episode for practical considerations to bring into your next contract review, renewal discussion, or conversation with a business owner.

Four federal regulators are proposing changes to third party risk management (TPRM) guidance. What is changing, how could it affect existing programs, and what might it mean for the future of TPRM? In September 2026, federal financial regulators proposed revisions to the Interagency Guidance on Third-Party Relationships: Risk Management, potentially reshaping how financial institutions approach TPRM. The proposal comes just three years after the first unified interagency guidance was finalized in June 2023. That guidance brought together the Office of the Comptroller of the Currency (OCC), Federal Reserve Board, and Federal Deposit Insurance Corporation (FDIC), replacing their separate supervisory guidance with a common framework. The 2023 guidance established a principles-based approach organized around the third party relationship lifecycle. It emphasized that risk management practices should reflect an institution's size, complexity, risk profile, and the nature of its third party relationships. The 2026 proposal retains those principles but places renewed emphasis on how they are interpreted and implemented. NCUA Joins the Interagency Framework One notable development is the addition of the National Credit Union Administration (NCUA) as a fourth participating agency. The NCUA did not participate in the 2023 guidance, and credit unions have historically relied on separate supervisory guidance for third party relationships. Its participation would extend the common framework to federally insured credit unions, promoting greater consistency across banks and credit unions while recognizing differences in their size, resources, and operational complexity. The inclusion of NCUA is also significant because it brings credit unions into a broader interagency discussion about proportionality, supervisory expectations, and the management of increasingly complex third party relationships. Why Revisit the Guidance After Only Three Years? The agencies acknowledge concerns that the 2023 guidance, despite its risk-based intent, has sometimes been interpreted too broadly. Detailed examples and recommendations have contributed to overly prescriptive practices, extensive documentation requirements, and checklist-driven approaches that may not reflect the actual risks of individual relationships. The proposal seeks to address these concerns by emphasizing proportional oversight, informed risk acceptance, and greater flexibility. Risk-based TPRM is not a new concept. What is changing is how explicitly the agencies are addressing interpretations of the guidance that may have encouraged unnecessarily prescriptive practices. The proposed guidance was published September 15, 2026, and the public comment period closes November 16, 2026. With less than two weeks remaining, practitioners and industry organizations still have an opportunity to provide feedback. The following analysis examines the most significant proposed changes, their potential implications for existing TPRM programs, and what they could mean for the profession. 1. From Lifecycle Management to Risk-Based Components The 2023 guidance organized TPRM around planning, due diligence and selection, contract negotiation, ongoing monitoring, and termination, supported by governance and oversight. The proposal reorganizes these activities into four components: Risk identification and assessment Risk oversight Residual risk acceptance Governance Traditional lifecycle activities remain within the risk oversight component. The revised structure places greater emphasis on identifying risks, evaluating their significance, and determining appropriate responses. This represents a change in organization and emphasis rather than a departure from lifecycle-based risk management. Potential Implications for TPRM Programs Existing lifecycle-based programs may remain consistent with the proposed framework. However, the revised structure could influence how institutions evaluate the relationship between individual TPRM activities and their broader risk management objectives. Programs with extensive procedural requirements may face greater questions about how those activities contribute to identifying, assessing, and managing material risks. 2. Risk Assessments: Moving Beyond Criticality The 2023 guidance placed particular emphasis on third parties supporting critical activities, which often became a primary driver of enhanced due diligence and monitoring. The proposal places greater emphasis on the magnitude and likelihood of potential harm associated with a relationship. A provider supporting an important operational function may present manageable risks because appropriate safeguards exist. Conversely, a provider supporting a less critical function could introduce significant cybersecurity, regulatory, financial, or reputational exposure. The distinction between operational criticality and the risks associated with a particular relationship may become increasingly important. Potential Implications for TPRM Programs The proposed approach could affect inherent risk assessment methodologies and risk-tiering models, particularly those that rely heavily on criticality classifications to determine oversight requirements. Programs that automatically assign enhanced due diligence or monitoring based on criticality may find that the proposed framework places greater emphasis on the specific risks associated with each relationship. The extent of the impact would depend on how an institution currently defines criticality, evaluates impact and likelihood, and determines appropriate oversight. 3. Due Diligence: Flexibility Without Sacrificing Defensibility The 2023 guidance provided extensive examples of due diligence considerations, including financial condition, information security, operational resilience, compliance, and subcontractor management. Although intended as risk-based considerations, these examples have sometimes been interpreted as standardized requirements. The proposal more explicitly recognizes that due diligence should correspond to the risks presented. It also acknowledges that providers may be unable or unwilling to supply certain information and that public information, independent assessments, certifications, or other credible sources may provide sufficient insight. The emphasis shifts toward whether an institution has enough reliable information to make an informed risk decision rather than whether every requested document has been obtained. Potential Implications for TPRM Programs The proposal could have implications for standardized due diligence questionnaires, evidence requirements, and assessment methodologies. Institutions that rely on uniform documentation requirements across broad categories of providers may have greater flexibility to determine what information is necessary for individual relationships. At the same time, less prescriptive requirements could place greater importance on the ability to substantiate why particular evidence was considered sufficient. 4. Contract Negotiation: Recognizing Commercial Realities The proposal acknowledges that institutions may have limited negotiating power, particularly with large technology providers or in markets with few alternatives. Rather than emphasizing the inclusion of every preferred contractual provision, it focuses on evaluating protections relevant to the relationship's risks. The proposal also recognizes that institutions may proceed despite certain contractual limitations when they understand and appropriately accept the resulting exposure. Potential Implications for TPRM Programs This approach could affect how institutions interpret contractual requirements and evaluate deviations from standard terms. Existing contract review practices may increasingly distinguish between provisions addressing material risks and those representing preferred contractual protections. The proposed framework may also place greater emphasis on how contractual limitations relate to residual risk decisions. 5. Ongoing Monitoring: Reconsidering Standard Review Cycles Many TPRM programs rely on standardized review schedules, such as annual assessments for high-risk providers. The proposal reinforces that monitoring frequency, scope, and intensity should correspond to assessed risk and evolve as circumstances change. While this principle existed in the 2023 guidance, the proposal places renewed emphasis on proportionality rather than uniform monitoring requirements. Potential Implications for TPRM Programs The proposed approach could influence how institutions establish monitoring schedules and determine the scope of periodic reviews. Programs that rely primarily on predetermined review frequencies may have greater flexibility to incorporate targeted, continuous, or event-driven monitoring. This could also affect how organizations evaluate the effectiveness of monitoring activities, particularly whether those activities identify meaningful changes in risk rather than primarily confirm completion of scheduled reviews. 6. Fourth-Party Risk: Clarifying the Boundaries of Oversight The proposed guidance clarifies that a third party's use of subcontractors does not ordinarily create a separate direct third party relationship between the subcontractor and the financial institution. Nor does it automatically establish an expectation of direct oversight. Institutions may manage subcontractor risks through the primary provider, including contractual requirements and evaluation of the provider's subcontractor management practices. Potential Implications for TPRM Programs This clarification could influence how institutions define the scope of fourth-party oversight. Programs that routinely require direct assessments of subcontractors may interpret the proposal as supporting greater differentiation based on the risks presented. It may also place greater emphasis on understanding how primary providers identify, manage, and monitor their own subcontractor relationships. The clarification does not diminish the importance of material fourth-party dependencies, particularly where they introduce significant operational, cybersecurity, or concentration risks. 7. Residual Risk Acceptance: From Exception to Core Component Perhaps the most meaningful conceptual change is the elevation of residual risk acceptance to a standalone component. The agencies explicitly recognize that eliminating third party risk is neither realistic nor the objective of effective risk management. Organizations routinely encounter circumstances where additional mitigation is unavailable, impractical, or disproportionate. A provider may refuse contractual terms, alternatives may not exist, or terminating a relationship may introduce greater risk. Risk acceptance was recognized in the 2023 guidance. The difference is the prominence given to it in the proposed framework. Potential Implications for TPRM Programs The proposed framework could bring greater attention to how institutions evaluate, document, and authorize residual risk acceptance. It may also highlight distinctions between accepting an identified risk and granting an exception to an established procedural requirement. Institutions with mature risk acceptance processes may see relatively little operational change, while others may find that the proposed framework places greater visibility on how these decisions fit within their overall risk management practices. 8. Governance: Accountability Without Unnecessary Complexity The proposed guidance retains governance as a fundamental component, including roles and responsibilities, risk appetite, reporting, documentation, and independent review. However, it more explicitly recognizes that there is no single correct governance structure. Governance practices are expected to reflect an institution's circumstances and risk profile. Potential Implications for TPRM Programs The proposal could influence how institutions evaluate governance structures, accountability, escalation practices, and management reporting. It may also contribute to broader discussions about whether traditional TPRM reporting provides sufficient insight into material third party risks. Operational measures such as assessment completion rates and overdue reviews remain useful, but the proposed emphasis on risk management effectiveness could increase attention to how those activities relate to actual risk exposure. 9. Collaborative Risk Management and Shared Resources The proposal recognizes the value of shared due diligence, industry consortia, independent assessments, certifications, consultants, and specialized technologies. These resources can reduce duplication and improve access to expertise, particularly for smaller institutions. However, institutions remain responsible for determining whether the information is sufficient for their specific circumstances. Potential Implications for TPRM Programs The proposed guidance could encourage broader consideration of collaborative approaches and external assessment resources. This may be particularly relevant where multiple institutions request substantially similar information from the same providers. It could also influence how institutions evaluate standardized assessments and certifications, including the extent to which those resources address risks specific to an individual relationship. 10. Supervisory Expectations: Guidance Is Not a Mandatory Checklist The proposal explicitly addresses the nonbinding nature of supervisory guidance. The agencies acknowledge that detailed examples and recommendations have sometimes been interpreted as mandatory requirements. The proposed guidance clarifies that deviations from its recommendations alone do not establish grounds for supervisory action. This does not eliminate accountability for applicable laws, regulations, or unsafe and unsound practices. Potential Implications for TPRM Programs This clarification could have implications for internal policies and procedures that incorporate examples from supervisory guidance as mandatory requirements. Institutions may distinguish more explicitly between legal obligations, supervisory recommendations, and internally established risk management practices. However, greater flexibility in supervisory guidance does not necessarily translate into immediate changes in established program requirements. Internal audit, compliance, management, and supervisory expectations may continue to influence how institutions interpret and apply the proposed framework. One of the more significant questions is whether greater regulatory flexibility will result in meaningful operational flexibility. 11. Supplemental TPRM Resources: What Happens to Existing Guidance? One of the less-discussed but potentially consequential aspects of the proposal is the proposed withdrawal of supplemental resources issued to support implementation of the 2023 guidance. The proposal specifically identifies two resources published in 2024. The 2024 Community Bank Guide Third-Party Risk Management: A Guide for Community Banks, issued by the OCC, Federal Reserve, and FDIC in May 2024, provided practical considerations for community banks applying the 2023 framework. It recognized the challenges smaller institutions face, including limited resources and negotiating leverage. The 2024 Joint Statement on Bank-Fintech Deposit Arrangements The Joint Statement on Banks' Arrangements with Third Parties to Deliver Bank Deposit Products, issued in July 2024, addressed risks associated with bank-fintech partnerships and other arrangements involving third parties that deliver deposit products and services. It highlighted concerns involving operational risk, compliance, customer relationships, recordkeeping, and appropriate oversight. What Is Changing? The agencies propose replacing the 2023 guidance and these supplemental resources with the new framework. They are also requesting comments on whether additional TPRM-related guidance documents, interpretive letters, or other resources should be rescinded. The withdrawal would remove specific supervisory reference materials that institutions have used to interpret and implement the broader guidance. For community banks, this could mean losing practical examples that help translate principles into operational requirements. For institutions managing fintech partnerships, it could mean greater discretion in how oversight is structured, but not reduced responsibility for the underlying risks. Withdrawing guidance does not eliminate the risks it addresses or any independently applicable legal requirements. Potential Implications for TPRM Programs The proposed rescission could affect institutions that have incorporated these supplemental resources into policies, procedures, assessment methodologies, or training materials. Community banks may face greater uncertainty about how to interpret broad principles without the practical examples provided by the 2024 guide. Institutions involved in bank-fintech partnerships may also need to distinguish between supervisory recommendations contained in the joint statement and obligations arising from other regulatory requirements. More broadly, the proposal raises questions about the role of supplemental guidance in establishing consistent expectations. Detailed examples can promote consistency, but they can also become de facto requirements when interpreted too prescriptively. A less prescriptive framework may provide greater flexibility while increasing the importance of institutional judgment and consistency in applying risk management principles. What Could This Mean for the Future of TPRM? Taken together, the proposed changes suggest a potential shift in how TPRM programs are designed, operated, and evaluated. For years, program maturity has often been associated with comprehensive processes, detailed questionnaires, extensive documentation, and standardized oversight. Those practices can provide value. However, more activity does not necessarily mean better risk management. Three broader implications deserve consideration. Greater Flexibility May Require Greater Accountability A less prescriptive framework could place greater importance on the quality of risk management judgment. If institutions have more discretion in determining due diligence, monitoring, and contractual expectations, the methodologies supporting those decisions may become increasingly important. Clear criteria, consistent application, appropriate governance, and sufficient documentation could take on greater significance. There is also a practical challenge: Internal audit teams, compliance functions, risk committees, and examiners may have established expectations based on existing processes. Whether the proposed flexibility translates into meaningful operational changes may depend on how these stakeholders interpret and apply the final guidance. Measuring Risk Management, Not Just Process Completion Traditional TPRM metrics frequently emphasize completed assessments, overdue reviews, outstanding findings, and documentation status. These measures describe how well-established processes operate but may provide less insight into whether programs identify material risks, support timely decisions, or reduce exposure. The proposed framework could influence how institutions evaluate program effectiveness, potentially placing greater emphasis on demonstrated risk management outcomes alongside traditional measures of process completion. It may also influence how organizations evaluate TPRM technology. Capabilities that support risk identification, analysis, and informed decision-making could receive greater attention alongside traditional workflow automation and documentation management. Implications Beyond Financial Services Although the proposed guidance is directed toward regulated financial institutions, its influence could extend beyond banking and credit unions. Banking guidance has long informed TPRM methodologies, questionnaires, risk-tiering practices, and program structures across industries. Healthcare, energy, insurance, technology, and other sectors face similar challenges involving expanding third party ecosystems, limited resources, inconsistent evidence, and increasingly complex dependencies. The proposed withdrawal of supplemental resources adds another dimension. If regulators move away from detailed implementation examples, institutions may increasingly rely on internal expertise, industry frameworks, professional education, and peer collaboration to interpret broader risk management principles. This could influence the role of professional associations, standardized assessment frameworks, and shared educational resources in supporting consistency across the profession. At the same time, there is a risk that industry-developed frameworks could become another set of prescriptive requirements if they are applied without sufficient consideration of organizational circumstances. Other industries retain their own regulatory obligations, but the broader discussion about proportionality, informed risk acceptance, and effective oversight may resonate across the TPRM profession. Final Thoughts: Managing Risk Versus Managing the Process The proposed guidance does not suggest that the fundamentals of TPRM are no longer relevant. Organizations still need to understand their third party relationships, identify risks, conduct appropriate due diligence, monitor performance, and maintain accountability. What may change is how much discretion institutions have in determining the most appropriate way to accomplish those objectives. For the TPRM profession, the proposal raises an important question: How should organizations balance structured processes, consistent oversight, and regulatory expectations with the flexibility needed to manage third party risks proportionately? The proposal does not diminish the importance of effective third party risk management. Rather, it signals a potential change in how regulators expect institutions to demonstrate that effectiveness. Whether the final guidance results in meaningful changes to established TPRM practices remains to be seen. Much will depend on the final language, supervisory interpretation, and how individual institutions translate those principles into their existing risk management frameworks. For the broader profession, the proposal offers an opportunity to examine the relationship between process maturity and risk management effectiveness, without assuming that one necessarily guarantees the other. Ultimately, the central question may not be whether organizations are doing enough TPRM, but whether their established practices provide a meaningful understanding of the risks they are intended to manage. Public Comment Opportunity The proposed Third-Party Risk Management Guidance was published September 15, 2026. Comments are due November 16, 2026. The agencies are seeking feedback on the proposed framework, including risk-based oversight and the potential rescission of existing guidance and supplemental resources. Practitioners and industry organizations have an opportunity to provide feedback on how these changes could affect real-world TPRM operations. Primary Sources Interagency Guidance on Third-Party Relationships: Risk Management, June 2023, 88 FR 37920. Proposed Third-Party Risk Management Guidance, September 2026, 91 FR 58536. OCC Docket OCC-2026-0793. Federal Reserve Docket OP-1881. About This Analysis This article is provided by the Third Party Risk Association (TPRA) for educational and informational purposes. It offers an interpretation of the proposed interagency guidance and its potential implications for third party risk management. It does not constitute legal, regulatory, or professional advice. The guidance remains a proposal and is subject to change. Author Bio Hilary Jewhurst Sr. Membership & Education Coordinator at TPRA Hilary Jewhurst is a seasoned expert in third party risk and risk operations, with nearly two decades of experience across financial services, fintech, and the nonprofit sector. She has built and scaled third party risk programs from the ground up, designed enterprise-wide training initiatives, and developed widely respected content that helps organizations navigate regulatory complexity with clarity and confidence. Known for turning insight into action, Hilary’s thought leadership and educational work have become go-to resources for professionals looking to mature their TPRM programs. She regularly publishes articles, frameworks, and practical guides that break down complicated risk topics into meaningful, accessible strategies. Hilary recently joined the Third Party Risk Association (TPRA) as a staff member, supporting industry-wide education, peer learning, and advancing best practices. She is also the founder of TPRM Success, a boutique consultancy that helps organizations strengthen their third party risk management capabilities through targeted training, tools, and strategic guidance.

Explore TPRM service provider resources, including tools and documents to enhance your risk management strategy. Access helpful links and information from various providers. Vendor-Provided Resources Here you can find links to resources supplied by TPRA Vendor Members (TPRM Service Providers). Some of these resources require you to input information to obtain the document. Note: TPRA does not support one particular service provider over another, nor do we benefit from providing you the links below. Read and implement at your own risk. If you are a TPRA Vendor Member and have a resource or link you would like to see added to this page, please submit through our Vendor Submissions form , or send it to Meghan Schrader at meghan.schrader@tprassociation.org for review. Filter by Resource Type Blog Checklist Company Information Datasheet Framework Guide Guidebook Infographic Magazine Newsletter Other Playbook Podcast Presentation Report Research State of the Industry Survey Results Template Tool Toolkit Video Whitepaper eBook Aravo When the Vendor’s Breach Becomes the Claim: How Aravo Helps Insurers Manage Third-Party Risk November 6, 2026 Explore third-party risk management for insurance and how AI-powered monitoring helps insurers manage TPA, broker, and compliance risks. View Resource Aravo Blog From Risk Signal to Response: A More Agile Approach to TPRM October 27, 2026 Learn how AI and domain expertise can help TPRM teams turn emerging risks and requirements into practical assessments, workflows, and ongoing oversight while keeping new applications connected to the broader program. View Resource Aravo Blog The TPRM Timing Gap: Why Operating Models Must Evolve at the Speed of AI October 27, 2026 Explore how AI is reshaping third-party risk management, expanding third-party exposure and challenging TPRM teams to adapt faster. View Resource Aravo Blog In TPRM, Data Governance Matters October 1, 2026 View Resource Aravo Blog Smarter Workflows, Faster Decisions: Bringing Agentic AI to Financial Services TPRM September 28, 2026 View Resource Vendict Whitepaper Drowning in Vendor Risk? How to Eliminate Backlogs Without Hiring More Staff September 17, 2026 Learn why traditional TPRM approaches struggle to keep pace with growing vendor ecosystems, and how a new model combining AI-powered automation, GRC expertise, and managed execution can eliminate assessment backlogs, improve risk coverage, and scale TPRM without adding headcount. View Resource Aravo Blog When Friction Becomes Risk: Why UX Is Your Strongest TPRM Control September 4, 2026 View Resource Aravo Blog Managing Upstream Exposure: What a Food Recall Teaches Us About Nth-Party Risk August 24, 2026 View Resource Black Kite Podcast, Blog Mythos Hype Check: TPRM Paradigm Shift or Big Nothing Burger? August 4, 2026 When a frontier AI model threatens to reshape the threat landscape, you do not stick to the editorial calendar. In the latest episode of the Third Party podcast, Jeffrey Wheatman , Bob Maley , and Ferhat Dikbiyik called an audible, pulling Black Kite CTO Candan Bolukbas into an off-cycle remote recording to answer the question every TPCRM practitioner is asking right now. Is Mythos a paradigm shift? Or is it a big nothing burger? The answer is neither. And understanding why that framing is wrong is exactly where the real work starts. View Resource Aravo Blog The Future of Third-Party Risk Management Is Human-Centered July 27, 2026 View Resource Aravo Blog Beyond Compliance: How Aravo Helps Financial Institutions Manage Third-Party Risk July 27, 2026 View Resource Aravo Blog Why Pharma Needs an Intelligence-First Approach to Third-Party Risk July 27, 2026 View Resource LOAD MORE

Join TPRA’s free 2025 Virtual Conference on September 10 to explore continuous improvement in Third Party Risk Management. Attend expert-led sessions, earn CPE credits, and enhance your TPRM strategy. 2026 Virtual Conference Emerging Risks & Operational Resiliency Wednesday, September 9, 2026 • 9:00 AM - 4:00 PM Central Open to All • Free • 6 CPE Credits Available View Presentations View Recordings (Members Only) Join the Third Party Risk Association (TPRA) for our 2026 Virtual Conference: " Emerging Risks & Operational Resiliency " on Wednesday, September 9 , 2026, from 9:00 AM to 4:00 PM CT . What to Expect As organizations navigate an increasingly complex risk landscape, this conference will explore the latest emerging threats—from evolving regulatory expectations to third party vulnerabilities and operational disruptions. Attendees will gain actionable guidance on strengthening resilience, enhancing risk frameworks, and proactively addressing uncertainties that can impact business continuity. Through expert-led sessions, participants will leave better equipped to anticipate challenges, adapt to change, and build more robust, future-ready organizations. Who Should Attend? This conference is ideal for: TPRM professionals seeking to enhance their programs Risk management and compliance officers Procurement and vendor management specialists IT and cybersecurity professionals involved in third party risk Whether you’re focused on third-party risk, enterprise risk, or operational continuity, this event offers valuable perspectives and tools to help you stay ahead in a rapidly shifting environment. Register Now TRACK 1 Driving Resilience Through Continuous Improvement TRACK 2 Driving TPRM Transformation Through Innovation TRACK 3 Navigating Emerging Risks & Regulatory Change Agenda Fliter by: Track 8:55 AM - 9:00 AM 5 minutes View Full Session Presentation Welcome & Kick-Off Julie Gaiaschi, CEO & Co-founder, TPRA Zoom Lobby General Session Kick off this virtual conference with a few words from Julie Gaiaschi , CEO & Co-founder… Read More 9:00 AM - 9:50 AM 50 minutes View Full Session Presentation From Headlines to Action - Managing Geopolitical Risk Across Third-Party Ecosystems Sandeep Suresh, Supply Wisdom Room 1 Track 1: Driving Resilience Through Continuous Improvement Geopolitical events no longer impact only global enterprises—they can disrupt organizations of every size through… Read More 9:00 AM - 9:50 AM 50 minutes View Full Session Presentation A New Can of Worms: Why Compliance Alone Can't Contain a Zero-Cost Adversary Richard Hummel, SecurityScorecard Room 2 Track 2: Driving TPRM Transformation Through Innovation Compliance frameworks are built on an assumption that no longer holds: that adversaries need time,… Read More 9:00 AM - 9:50 AM 50 minutes View Full Session Presentation Beyond the Checklist: Building a Unified Third-Party Control Framework Jan Stappers, LL.M., PgD EVP, GRC Solutions Strategy, Mitratech Room 3 Track 3: Navigating Emerging Risks & Regulatory Change The TPRM landscape has become a maze of overlapping mandates, standards, and stakeholder expectations, and… Read More 10:00 AM - 10:50 AM 50 minutes View Full Session Presentation Continuous Monitoring That Improves Oversight Ken Wolckenhauer, Nordea Bank Room 1 Track 1: Driving Resilience Through Continuous Improvement Turning on risk monitoring and alert feeds is easy but turning them into better decisions… Read More 10:00 AM - 10:50 AM 50 minutes View Full Session Presentation Moving at Attacker's Speed: How to Rethink TPRM for the Post-Mythos Era Jake Olcott, Bitsight Room 2 Track 2: Driving TPRM Transformation Through Innovation Third-party risk management was built for a slower world. Today, organizations face a growing volume… Read More 10:00 AM - 10:50 AM 50 minutes View Full Session Presentation Gaining c-suite acceptance of emerging risks: regulation is your friend Rachel Elliott, DRI Room 3 Track 3: Navigating Emerging Risks & Regulatory Change Navigating emerging supply chain risks is becoming evermore complex, particularly with events become concurrent. The… Read More 11:00 AM - 11:50 AM 50 minutes View Full Session Presentation The Risk You Reviewed Isn’t the Risk You Have Natalie Druckmann, Certa Room 1 Track 1: Driving Resilience Through Continuous Improvement The third-party risk function is caught between two converging threats and most programs are equipped… Read More 11:00 AM - 11:50 AM 50 minutes View Full Session Presentation Staying One Step Ahead: Why Intelligence Is Replacing Traditional Third-Party Risk Management Austin Starowicz, RiskRecon Room 2 Track 2: Driving TPRM Transformation Through Innovation Cybersecurity isn't becoming more difficult because organizations have more vendors—it's becoming more difficult because adversaries… Read More 11:00 AM - 11:50 AM 50 minutes View Full Session Presentation The Risks Beyond the Hype: Operational Resilience, Hidden Financial Exposure, and the Next Frontier of TPRM Courtney Turner, Deere & Co Room 3 Track 3: Navigating Emerging Risks & Regulatory Change As organizations race to manage AI-related risks, other emerging threats are quietly gaining momentum. This… Read More 12:00 PM - 1:00 PM 60 minutes View Full Session Presentation Lunch Meal Take a break to enjoy some lunch before jumping back into learning with our next… Read More 1:00 PM - 1:50 PM 50 minutes View Full Session Presentation Your Vendor Didn’t Change, But Its AI Did: Rethinking Material Change in TPRM Brian Shaw, Independent Room 1 Track 1: Driving Resilience Through Continuous Improvement A third party may remain under the same contract while quietly changing its models, data… Read More 1:00 PM - 1:50 PM 50 minutes View Full Session Presentation When Risk Evolves, Agility Wins: AI Transforms Third-Party Risk Management Bryn Sedlacek, Aravo Room 2 Track 2: Driving TPRM Transformation Through Innovation Today's TPRM programs must support resilient operations, secure IT, ethical business practices, regulatory compliance, and… Read More 1:00 PM - 1:50 PM 50 minutes View Full Session Presentation Third-Party Risks and Sanctions Michael Volkov, Volkov Law Group Room 3 Track 3: Navigating Emerging Risks & Regulatory Change With the beginning of the aggressive trade enforcement era, companies need to focus on third-party… Read More 2:00 PM - 2:50 PM 50 minutes View Full Session Presentation Fourth-Party Risk: The Exposure You Can’t Always See Tracey Forney, previously Sr Information Security Manager with Federal Reserve Room 1 Track 1: Driving Resilience Through Continuous Improvement Dependencies on sub-contractors and upstream providers can introduce risk that is not obvious from primary… Read More 2:00 PM - 2:50 PM 50 minutes View Full Session Presentation We Don’t Know What We Don’t Know: The Inherent Risk of Mature TPRM Paul Valente, VISO TRUST Room 2 Track 2: Driving TPRM Transformation Through Innovation A vendor assessment can be thorough and defensible while still missing the risk that matters.… Read More 3:00 PM - 3:50 PM 50 minutes View Full Session Presentation The AI-Enabled Vendor: Building a Third-Party AI Risk Assessment Aligned to NIST AI RMF Nitin Agarwal, Luminace Room 1 Track 1: Driving Resilience Through Continuous Improvement Third-party vendors are rapidly embedding generative and agentic AI into the services organizations already consume,… Read More 3:00 PM - 3:50 PM 50 minutes View Full Session Presentation Beyond the AI Hype: What’s Actually Working in Third-Party Risk Management Sophia Corsetti, ProcessUnity Room 2 Track 2: Driving TPRM Transformation Through Innovation AI has produced no shortage of demos, claims, and new terminology. But after the initial… Read More 2:00 PM - 2:50 PM 50 minutes View Full Session Presentation From Finding to Fixing: Managing Third-Party Issues, Exceptions & Performance Kholofelo Mothibi, Corebride Financial Room 3 Track 3: Navigating Emerging Risks & Regulatory Change Identifying a vendor risk is only the beginning. The real test of a TPRM program… Read More 3:50 PM - 4:00 PM 10 minutes View Full Session Presentation Conference Conclusion Julie Gaiaschi, CEO & Co-founder, TPRA Zoom Lobby General Session We will close out this event with a few announcements and drawings for raffle prizes! Speakers Apply to Speak Courtney Turner Enterprise Third Party Risk Manager Deere & Co Paul Valente Co-founder & Chief Customer Officer VISO TRUST Richard Hummel VP, Threat Intelligence SecurityScorecard Brian Shaw Third-Party Risk & Compliance Executive Independent Ken Wolckenhauer Head of Vendor Management Nordea Bank Maxine Ayers Director Operational Risk Management Corebridge Financial Kholofelo Mothibi Head of TPRM Corebridge Financial Natalie Druckmann VP, Head of EMEA Certa.ai Sandeep Suresh Managing Director Supply Wisdom Sophia Corsetti Sr Product Marketing Manager ProcessUnity Nitin Agarwal Director Enterprise AI & Risk Luminace Tracey Forney previously Sr Information Security Manager Federal Reserve Bryn Sedlacek VP, Product Management Aravo Solutions, Inc Michael Volkov CEO The Volkov Law Group PC Austin Starowicz Director, Solutions Consulting Mastercard Cybersecurity Rachael Elliott Director of Global Strategy and Innovation DRI International Jake Olcott VP Government Affairs Bitsight Jan Stappers LL.M., PgD EVP, GRC Solutions Strategy Mitratech Prevalent Julie Gaiaschi CEO & Co-founder Third Party Risk Association (TPRA) Thank you to our Sponsors ! Interested Sponsors Be sure to visit their virtual booths during the event!

Explore TPRA’s TPRM Consultant Membership plans designed for independent consultants and boutique firms offering third party risk advisory services. Consultant Catalyst Plans Target Audience: Single, Independent Consultants or Boutique Advisory Firms specializing in third party risk management services, including but not limited to TPRM program implementation, tool implementation, and/or staff augmentation. INQUIRE ABOUT MEMBERSHIP About This Membership Plan The Consultant Catalyst Plan is a tailored membership option designed specifically for independent consultants and boutique advisory firms that specialize in third party risk management. Recognizing that these high-expertise professionals often operate with limited marketing resources, TPRA has created an accessible, affordable pathway into its practitioner-driven ecosystem. Through this membership, consultants gain the opportunity to build visibility, credibility, and relevance in a highly targeted community of TPRM professionals. This plan provides structured, ethical exposure to the TPRA network, including guidance on lead generation strategies that respect practitioner boundaries while helping consultants showcase their expertise. Members are encouraged to engage directly in community discussions, contribute thought leadership, and demonstrate their unique value through active participation. While TPRA does not guarantee leads, the Consultant Catalyst Plan creates the foundation for long-term relationship-building, increased brand recognition, and a stronger position in the TPRM space. Key Objectives 1 Provide affordable entry to the TPRA ecosystem. 2 Offer guided lead generation strategies (without violating practitioner privacy). 3 Enable visibility and credibility for consultants. 4 Encourage active participation to demonstrate value. INQUIRE ABOUT MEMBERSHIP Key Benefits Explore a brief overview of the benefits included in our Consultant Catalyst Plan. Exclusive Access to Practitioner-Focused Events Gain invitations to all TPRA Practitioner meetings, including Industry Roundtables and Insight Work Groups. Participate as a panelist or presenter once a year and engage in collaborative development of TPRA tools and guidance—all in a no-solicitation environment that fosters trust and expertise. Lead Generation & Networking Tools Participate in bi-annual Consultant Connector Events with interested practitioners. Plus, use the TPRA's “Lead Generation Blueprint” Toolkit to guide compliant, value-driven outreach based on best practices. Strategic Visibility & Promotion Opportunities Showcase your expertise through a curated TPRA Consultant Directory Profile, a LinkedIn spotlight post, Consultant Corner blogs, and the opportunity to be featured in TPRA’s quarterly newsletter. Position your firm as a recognized thought leader within the third party risk community. Business Growth & Peer Exchange Forums Join quarterly Consultant Roundtables—exclusive, TPRA-moderated sessions where you’ll share challenges, trends, and business growth strategies with fellow consulting peers in a supportive and strategic environment. Co-Hosted Event Collaboration TPRA will partner with your organization to co-host webinars, LinkedIn Live sessions, and/or podcasts. Leverage TPRA’s promotion while leading discussions that highlight your niche knowledge and solutions in front of a relevant and engaged audience. Recognition, Resources & Professional Development Apply for the TPRM Innovator Award, access discounts on certifications for consultant teams, and post jobs on TPRA’s career board. Contribute educational content, share surveys, and participate in our Women in TPRM Program. Consultant Catalyst Members Inquire About Membership Heather Kadavy Senior Membership Success Coordinator heather.kadavy@tprassociation.org Follow on LinkedIn > Vendor Membership Inquiry Complete this form if you are interested in one of TPRA's Service Provider Membership options (Vendor Membership, Incubator Program, Consultant Catalyst). Our team will reach out to you as soon as possible with further details on plan benefits and pricing. First name* Last name* Job Title* Organization* Email* Phone Which membership option are you interested in? Vendor Membership – For established TPRM Service Provider organizations (TPRM Platform, GRC Platform, Risk Rating/Intelligence Tool, TPRM Services, etc.). Incubator Program – For Start-Up TPRM Service Provider Organizations looking to gain insight, support, and promotion. Consultant Catalyst – For single, Independent Consultants or Boutique Advisory Firms specializing in third-party risk management services. Other Anything else we should know? Submit