Search Results

Most third party incidents come to light before the third party officially reports them. Usually, the first sign is indirect; a service slows down, a business owner notices access problems, a customer-facing team spots a disruption, or an alert goes off with little detail. By the time the third party confirms the issue, internal teams are already asking key questions: what is affected, what data is involved, who manages the relationship, what does the third party need to do under contract, and what options are available if service is not restored quickly.  Here, the extended enterprise means all the outside organizations that help the business run , including both third parties and the fourth parties they depend on. This matters during incident response because the i mpact and the root cause are often in different places. For example, a fourth party might cause a disruption, but the response still goes through the third party covering contracts, communication, evidence requests, and recovery promises. Third Party Risk Management (TPRM) teams need to make this chain clear and actionable during an incident.  Incident response and recovery in the extended enterprise are just as much coordination issues as technical ones. Security teams focus on containment and investigation. Privacy and Legal teams assess notification and contractual obligations. Business owners need to keep operations running and manage third party accountability. Continuity teams need recovery assumptions and workaround options. Procurement needs contract visibility and leverage. TPRM sits in the middle, translating third party relationships into a decision-ready context, so the response does not stall while teams reconstruct basic information.   This blog shares practical ways TPRM practitioners can help with incident response and recovery when third party incidents happen across the extended enterprise. The focus is on tools and processes that work during real incidents, not just on perfect documentation. The aim is to cut down the time spent on getting oriented, escalating issues, and tracking down information, so teams can act faster on impact, third party accountability, and recovery.  Maintain third party records for use during an incident.  When a third party problem comes up, the first challenge is getting oriented. Teams need to know who manages the third party, what the third party does, and how much disruption the business can handle.  TPRM programs should ensure third party records include:  A clearly identified business owner with authority to engage the third party.  The services provided and systems involved.  The types of data accessed or processed.  Whether the service supports customer-facing, revenue-generating, or regulated activity.  If teams have to gather this information after an incident begins, the response slows down and coordination suffers.  Practitioner takeaway: Ensure third party inventories are immediately usable during real incidents, not just for onboarding or annual reviews, so teams can quickly access orienting information.  Use risk tiering and operational criticality to define response expectations.  Risk tiering sets the basic level of oversight. Operational criticality shows if a problem with this third party would have an immediate effect on the business.  Each third party should have:  An inherent risk tier  An operational criticality designation, critical or not critical  Together, these factors should guide:  Notification and response timelines  Evidence and information requests during incidents  Leadership escalation and continuity involvement  For third parties that are critical to operations, these expectations should be agreed on and documented ahead of time. This includes clear escalation paths and recovery plans the business depends on.  Practitioner takeaway: Use risk tiering to set oversight expectations. Use operational criticality to determine how quickly a third party issue becomes a business-impact decision.  Treat fourth-party involvement as a normal part of the response.  Many third party incidents involve a fourth party, like a hosting provider, cloud platform, or specialized subcontractor. During a response, teams need to know if a fourth party is part of the delivery chain and if that changes recovery options.  Programs tend to be more effective when they:  Require third parties to disclose material fourth parties that affect service delivery or data exposure.  Apply this requirement primarily to operationally critical third parties.  Require notification when material fourth parties change.  This helps teams quickly assess impact and recovery limits, avoiding the slow process of rebuilding the supply chain during an active incident.  Practitioner takeaway: Focus fourth party visibility on the most important dependencies related to service delivery and data exposure for effective response.  Monitor for service disruptions and security events.  Third party incidents often start as performance issues. Service instability, missed Service Level Agreements (SLAs), or delayed results usually show up before there is a formal incident notice.  Monitoring practices should clearly define:  Which conditions require review.  Who is responsible for follow-up.  What triggers incident escalation.  A practical way to divide responsibilities is:  Business owners monitor performance, manage day-to-day third party relationships, and escalate when a disruption appears credible.  TPRM checks the third party’s risk tier and criticality, confirms escalation paths and contacts, and sends the issue to the right internal teams based on the third party’s profile.  Security, Privacy, Legal, and Continuity teams get involved once the situation is considered an incident, either because the third party declares it or internal teams confirm a possible security, data, or continuity impact.  Practitioner takeaway: Set a defined point for when an issue escalates to a formal incident, ensuring clear responsibility transfer.  Align incident response with recovery and continuity planning.  For third parties that are critical to operations, incident response and recovery planning often overlap. A security problem can quickly turn into an availability or customer-impact issue with little warning.   Organizations are better prepared when they have a shared approach for third party response and recovery. This should include:   Notification requirements and evidence expectations.  Impact assessment inputs.  Decision authority and escalation paths.  Recovery time and recovery point assumptions.  Workaround and alternate sourcing options.  Talking through scenarios that include third party outages helps teams understand limits before a real disruption happens.  Practitioner takeaway: Integrate recovery planning into incident response so that recovery steps are considered as part of overall incident handling, not left until later.  Address AI-related incident considerations during intake and contracting  When third parties use AI, it affects data handling, control processes, and regulatory risks during incidents. These issues are hard to solve in the middle of a response.  Practical preparation includes:  Identifying where AI is used and what data it touches.  Requiring notice of material changes to AI-enabled workflows.  Aligning incident notification and investigation expectations contractually.  This helps reduce uncertainty when incidents happen.  Practitioner takeaway: Define incident response expectations for AI usage and data handling with third parties before incidents happen to avoid delays.  Consider regional and geopolitical disruption in third party recovery planning.  Regional outages, sanctions, and infrastructure failures often hit third parties before they affect your own operations.  Preparation should include:  Identifying regional concentration across operationally critical third parties.  Understanding which services can pause and which cannot.  Discussing realistic disruption scenarios with continuity stakeholders.  These talks often reveal single points of failure that might otherwise go unnoticed.  Define ownership and decision authority in advance.  Third party incidents take longer to resolve when it is unclear who is responsible. TPRM can help speed things up by making the structure clear.  Programs should ensure:  Every third party has a named business owner.  Escalation and risk acceptance authority are documented.  There is a defined forum for remediation decisions, exceptions, renewals, and exits.  Exceptions have owners and review dates.  Clear authority helps resolve incidents faster.  Practitioner takeaway: Address structural issues, like unclear ownership and escalation paths, to reduce delays during third party incidents.  Track incident-relevant measures, not activity volume.  Leadership oversight gets better when reports focus on risk exposure and follow-up, not just on program activity.  Measures that tend to support decision-making include:  Coverage of current validation for operationally critical third parties.  Known material fourth-party exposure for operationally critical third parties.  Time to initiate triage for third party incidents.  High-risk issues that exceed agreed remediation timelines.  Concentration risk across essential services.  These measures help teams focus on what matters most and escalate issues as needed.  Practitioner takeaway: Ensure reporting enables clear decision-making by emphasizing risk exposure and remediation status.  Summary   Effective incident response and recovery in the extended enterprise rely on preparation that supports coordination, clear ownership, and predictable escalation. TPRM teams add the most value when third party records are ready to use during incidents, response expectations are based on risk and criticality, and recovery planning is part of the response process. Fourth-party involvement should be seen as a normal part of third party delivery, with clear visibility into key dependencies for the most important third parties.  Author Bio Hilary Jewhurst Sr. Membership & Education Coordinator at TPRA Hilary Jewhurst  is a seasoned expert in third party risk and risk operations, with nearly two decades of experience across financial services, fintech, and the nonprofit sector. She has built and scaled third party risk programs from the ground up, designed enterprise-wide training initiatives, and developed widely respected content that helps organizations navigate regulatory complexity with clarity and confidence. Known for turning insight into action, Hilary’s thought leadership and educational work have become go-to resources for professionals looking to mature their TPRM programs. She regularly publishes articles, frameworks, and practical guides that break down complicated risk topics into meaningful, accessible strategies. Hilary recently joined the  Third Party Risk Association (TPRA)  as a staff member, supporting industry-wide education, peer learning, and advancing best practices. She is also the founder of  TPRM Success , a boutique consultancy that helps organizations strengthen their third party risk management capabilities through targeted training, tools, and strategic guidance.

In TPRA’s December blog, “TPRM State of the Industry: The 2026 Risk Reality Check,” Heather Kadavy laid out what many practitioners are dealing with heading into 2026, deeper dependency chains, more AI use by third parties, higher expectations for ongoing oversight, and external pressures that land through suppliers.    This blog will discuss what to do with that reality in practice. The sections below focus on preparation and actions that can be put in place early and reused throughout the year, so programs are not rebuilding workflows every time a third party issue surfaces.    What follows is practical guidance, not a maturity model or a checklist. The goal is usable steps that support consistent execution as issues surface.     1) Third Party visibility that supports decisions  Third Party issues often become harder to manage once the same questions circulate across functions. Questions such as who is involved, what systems or data are affected, and which dependencies sit behind the third party. When that information is fragmented, early coordination slows.  Consolidate third party inventories across Procurement, IT, Cyber, Privacy, Finance, and Compliance.  Tag third parties with service, data they can access, criticality, connectivity, primary hosting region, and key sub-service providers.  Track unknowns, such as unclear data exposure or missing sub-service provider detail, and reduce them over time.  Visibility supports alignment when decisions are needed.  2) Tiering for effective and efficient risk management  As third party populations grow, tiering becomes essential to keep program requirements proportional to inherent risk. The point is not only due diligence depth. Tiering and criticality help structure how the program addresses the most common risks and the biggest threats in a consistent way.  Define your risk tiers ( high, moderate, and low) using inherent risk factors such as data sensitivity, access level, operational criticality, concentration risk, regulatory compliance and geography.  Identify third parties that are essential to operations , interact directly with customers , or could reasonably drive regulatory scrutiny if they fail or experience an incident, and flag them as critical .  Assign every third party both a risk tier and a critical or not critical designation, so the program can clearly identify which vendors require the most scrutiny, due diligence, monitoring, and oversight.  Use the risk tier to set baseline program requirements, such as due diligence scope, evidence expectations, monitoring cadence, issue management timelines, and escalation triggers.  For critical third parties , set heightened requirements across contracts, business continuity and disaster recovery expectations, scenario testing, performance monitoring, and incident coordination.  The intent is to structure program effort around where risk and impact concentrate.  3) Practical Nth-party accountability  Sub-service provider exposure often becomes visible after an issue has already arisen. At that point, teams are working to understand who else is involved and what leverage exists.  Require disclosure of material sub-service providers, hosting locations, and changes that affect data or service delivery.  Request sub-service provider data maps for critical third parties only, focused on dependencies that carry real impact.  Start with a small group of critical third parties and expand once the process is repeatable.  Sub-service provider work tends to be most useful when it starts with the dependencies that affect service delivery or data exposure, then broadens over time.  4) Monitoring with clear ownership, including performance  Many organizations receive more third party risk information than they can act on. Without thresholds and ownership, monitoring loses operational value. Monitoring also needs to cover performance, not just risk events, because service degradation and missed deliverables often surface before a formal incident.  Define a short list of conditions that require attention, such as breach disclosures, ransomware activity, sanctions exposure, financial distress, critical vulnerability exposure, major control changes, or sustained service issues.  TPRM sets the cadence and requirements for monitoring based on risk tier and criticality, including what must be reviewed, how it is documented, and when escalation is required.  The business owner manages third party performance and is accountable for driving timely, complete remediation with the third party, including Service Level Agreement (SLA) review, corrective actions, and escalation when customer or operational impact is at stake.  Ownership and accountability drive follow-through and better outcomes.  5) Third party incident readiness and continuity coordination  Third Party incidents rarely affect just one function. They can raise legal questions, trigger privacy assessments, affect operations, or require triage from Information Security teams. When a critical provider is degraded or offline, business continuity and recovery planning becomes part of the same conversation.  Develop a third party incident and continuity playbook with cyber, legal, privacy, procurement, business owners, and business continuity and recovery stakeholders. Include notification and evidence requests, impact assessment, escalation paths, communications, recovery time and recovery point expectations, workaround options, and decision points for failover or alternate sourcing.  Run tabletop exercises that include both incident handling and service disruption scenarios, using at least one critical third party as the case study.  Confirm 24/7 contacts, notification SLAs, and continuity-related commitments for critical third parties, including recovery objectives and support expectations during disruptions.  Preparedness here reduces confusion during incidents and shortens the path from impact to recovery.  6) AI governance in intake and contracts  AI use by third parties can affect data handling, security controls, and compliance obligations. Addressing expectations early helps reduce rework later.  Ask where AI is used, what data it touches, if data is used to train models, retention practices, access controls, and incident handling.  Include contract language on data use, transparency, and notification when AI-related practices change.  Require third parties to identify material changes to AI-enabled features, underlying model providers, or data processing workflows that could affect confidentiality, integrity, availability, privacy, or regulatory obligations.  The goal is oversight and defensible governance, not blocking adoption.  7) Regional and geopolitical disruption  External pressures often reach organizations through suppliers. Preparation means thinking through how disruption would affect service delivery and contractual obligations.  Identify single points of failure by region, facility, cloud zone, or logistics route.  Document substitution options and what can be paused if disruption occurs.  Run scenario exercises tied to regional or geopolitical disruption and update continuity assumptions.  Scenario work surfaces dependencies that are otherwise easy to miss.  8) Cross-functional integration  Third party issues tend to escalate when relationship ownership, escalation paths, and decision authority are not clearly defined.  Name a business owner for each third party to own the relationship and drive risk remediation. Document risk acceptance authority and escalation paths, typically an executive owner or committee.   Hold regular decision meetings for exceptions, remediation approvals, renewals, access changes, and exits.  Maintain an exceptions register with clear expiration dates.  Regular coordination keeps decisions moving and reduces friction when issues span multiple functions.  9) Develop a scorecard leadership will use  A small, consistent scorecard helps leadership see where risk is concentrated and where follow-up is lagging.  Track a limited set of measures:  Percent of critical third parties with current evidence-based validation  Percent with known material sub-service providers  Time to triage third party incidents  High-risk issues past agreed timelines  Concentration risk across core functions  Metrics are most useful when they inform decisions and drive action.  Closing thought  None of these actions require rebuilding a TPRM program. They require clarity on roles, a disciplined way to separate critical third parties from the broader population, and monitoring and escalation approaches that connect risk signals to real follow-up. The programs that hold up best tend to be steady on the fundamentals, especially when third party issues arrive alongside procurement deadlines, operational pressure, and leadership questions.  Author Bio Hilary Jewhurst Sr. Membership & Education Coordinator at TPRA Hilary Jewhurst  is a seasoned expert in third party risk and risk operations, with nearly two decades of experience across financial services, fintech, and the nonprofit sector. She has built and scaled third party risk programs from the ground up, designed enterprise-wide training initiatives, and developed widely respected content that helps organizations navigate regulatory complexity with clarity and confidence. Known for turning insight into action, Hilary’s thought leadership and educational work have become go-to resources for professionals looking to mature their TPRM programs. She regularly publishes articles, frameworks, and practical guides that break down complicated risk topics into meaningful, accessible strategies. Hilary recently joined the  Third Party Risk Association (TPRA)  as a staff member, supporting industry-wide education, peer learning, and advancing best practices. She is also the founder of  TPRM Success , a boutique consultancy that helps organizations strengthen their third party risk management capabilities through targeted training, tools, and strategic guidance.

Navigating Ownership, Oversight, and Expertise in the Age of Artificial Intelligence  As artificial intelligence (AI) adoption accelerates across industries, organizations are grappling with a new challenge: where should AI risk management, and specifically AI-related Third Party Risk Management (TPRM), live within the enterprise?  While some organizations assign ownership to existing structures like IT, model risk management, or cybersecurity, others manage AI/TPRM through risk committees or distributed governance models.  However, as AI becomes embedded in everything from third party software to operational decision making, defining accountability and expertise is more critical than ever.  This blog explores the current state of organizational ownership of AI/TPRM, the challenges of fragmented accountability, and the evolving landscape of AI risk governance.  The Current Reality: Distributed Ownership, Fragmented Accountability  Most organizations are still in the early stages of formalizing how AI and third party risk intersect. The result is a patchwork of ownership that reflects historical structures rather than emerging needs.  Common Models of AI/TPRM Ownership:  Model Typical Owner Strengths Challenges IT Ownership CIO or Head of IT Deep technical knowledge; integration visibility Focused on enablement over risk; limited governance scope Cybersecurity Ownership CISO or Security Team Expertise in data protection, privacy and threat management May overlook model bias, ethics and performance risk Model Risk Management (MRM) CRO, Enterprise Risk or Finance Familiar with validation frameworks and model governance Not all AI tools qualify as “models”; hard to scale across third parties. Enterprise Risk Management Chief Risk Officer Holistic view of risk across functions May lack the technical fluency needed to assess AI-specific risks Governance Committee or AI Council Cross Functional Groups Encourages shared accountability Decision-making can be slow; unclear escalation or ownership paths In practice, AI/TPRM often lives everywhere and nowhere at all.   This distributed reality makes it difficult to establish clear accountability, consistent controls, or effective monitoring.   The Expertise Dilemma: Interest, Enthusiasm, and Illusion  AI governance has quickly attracted attention across business functions.  Within most organizations, there are three groups emerging:  The Interested:  Professional who wants to understand AI’s risk and opportunities but lack hands-on experience.  The Aspiring Expert:  Individual who follows AI trends and participates in governance conversations but may not yet grasp the nuances of model architecture or data provenance.  The Actual Experts:  Technologist, data scientist, and risk professionals who understand both the technical and ethical implications of AI.  The challenge is not a shortage of passion, it's a shortage of true multidisciplinary expertise.  AI/TPRM sits at the intersection of technology, ethics, and compliance, few individuals or departments are fluent in all three.  To close this gap, organizations must create intentional learning pathways and collaborative governance structures that balance subject matter expertise with enterprise risk accountability. Governance in Practice: Moving Towards a Federated Model  A leading practice emerging across industries is a federated governance model for AI and TPRM. This structure combines distributed ownership with centralized oversight.  Key Features of a Federated Model  Central Oversight Body  – An AI Risk or Governance Committee that sets policy standards, and reporting expectations.   Functional Ownership – Each business or function (e.g., IT, Cyber, Risk, Legal, Procurement, etc.) owns execution of AI/TPRM controls relevant to their domain.  Integration with TPRM – Third party due diligence processes are expanded to include AI-specific assessment covering model transparency, ethical design, data sourcing, and bias testing.  Continuous Monitoring – Establish ongoing oversight for AI-enabled third party tools, especially for evolving and retraining models.  This model encourages shared responsibility while ensuring decisions align with enterprise-level risk appetite and ethical standards.   A Practical Path Forward  Organizations can begin clarifying AI/TPRM ownership with the following steps:  Map Current Ownership – Identify where AI activities and risk currently reside(within IT, Cyber, Risk or elsewhere).  Establish an AI Governance Charter – Define roles, responsibilities, and decision rights for all AI-related risk activities, including third party AI vendors.  Integration of AI Risk into TPRM Frameworks – Update third party due diligence questionnaires/assessments and monitoring processes to include AI use, transparency, and data ethics.  Create a Skills Development Roadmap – Offer training that bridges the technical, operational and ethical dimension of AI risk.  Promote Transparency and Communication – Encourage open dialogue between those who “build”, those who “buy”, and those who “govern” AI.  Where AI/TPRM “lives” is not a static question, it's a reflection of how mature an organization is in managing emerging risk. Ownership will likely evolve over time, shifting from isolated functions to integrated governance models.   Ultimately, the goal isn’t to decide whether IT, Cyber, or Risk “owns” AI. It's to ensure that someone is accountable,  that the process is transparent, and decisions are made responsibly.  AI will continue to reshape third party risk management. Those who establish clarity of ownership today will be better equipped to manage the risks and seize the opportunities of tomorrow.  Author Bio Heather Kadavy Senior Membership Success Coordinator Heather Kadavy  joined the Third Party Risk Association (TPRA) in 2023 as the Senior Membership Success Coordinator. In recent year(s) Heather has been providing freelance TPRM consulting work to various organizations after retiring from a Nebraska financial institution after nearly 35 years where she oversaw and managed critical programs of the organization including Third Party Risk Management, Information Security, Physical Security, Safety, Business Recovery, Financial Crimes, Model Risk Management, and Enterprise Risk Management.  In her TPRM role she had oversight of over a thousand third party relationships, systems, due diligence reviews and contract management activities.  She developed, facilitated, and implemented training programs for thousands of employees over the years. Heather is a natural born connector of people and values relationship building at the cornerstone of her career.  She encourages you to connect with TPRA and herself via LinkedIn to join in the "TPRM Global Conversation".

In many Third Party Risk Management (TPRM) programs, contracts and service-level agreements (SLAs) are signed, filed, and then forgotten. That is, until a renewal deadline sneaks up, or a vendor fails to meet a critical performance standard, whereby no one can prove whether the vendor was or wasn’t held accountable.  If that sounds familiar, you’re not alone.  Contract and SLA management are two of the most underrated yet high-impact areas for TPRM automation. And the good news? You don’t need a massive system overhaul to start reaping the benefits.  Why Contract & SLA Monitoring Matters in TPRM  Contracts contain the DNA of your third party relationships. They note:  What services are being delivered  What controls are expected  When the agreement expires or renews  What happens if something goes wrong  If this information lives in static PDFs or folders, and relies on someone to remember key dates or terms, you’re exposing your organization to real risk. Such risks include, but are not limited to:  Missed renewals that may auto-renew unfavorable terms  SLA violations that go undetected and un-remediated  Unenforced obligations that weaken your risk posture  Automation can help solve this problem. And it doesn’t have to be complex.  What You Can Automate  Here are several key elements of contract and SLA management you can automate today:    1. Key Date Reminders  Renewal and termination notice deadlines  Compliance documentation expiry (e.g., updated SOC 2 required every 12 months)  Review cycles (e.g., quarterly performance check-ins)  Automation example:  Auto-alerts at 90/60/30 days before renewal, with owner assignment and status tracking.     2. Obligation Tracking  Ensure third parties deliver required evidence (e.g., updated pen test results)  Auto-track performance standards (e.g., response times, uptime, ticket resolution)  Flag when obligations aren’t met  Automation example:  Use automated tools to extract obligations from contracts and load them into a tracker that flags upcoming deliverables.     3. SLA Monitoring Integration  Link with operational data (e.g., help desk platforms, uptime monitors) to auto-validate whether SLA commitments are being met.  Set automated thresholds for escalation if a third party exceeds a defined limit (e.g., >3 late response tickets in a month).  Automation example:  When help desk tickets tied to a third party cross a certain age threshold, an alert is triggered to the TPRM team.  Real-World Example: Automating Renewal Notifications in a Mid-Sized Bank  A regional U.S. bank had thousands of third parties with contracts stored across multiple departments. Renewal dates were tracked in spreadsheets, and deadlines were frequently missed, resulting in automatic renewals that locked the organization into poor terms.  “We didn’t realize how often we were defaulting to auto-renewal until we missed our shot at renegotiating a major payment vendor,” the TPRM manager shared.   The team implemented a contract tracker tied to their TPRM tool that extracted and logged:  Contract expiration dates  Required notice periods  Assigned contract owners  Automated alerts were triggered on 90, 60, and 30 days before key dates, with color-coded status dashboards.  Impact:   100% of critical third party renewals reviewed on time  Saved ~$300K through renegotiated terms in Year 1  Improved coordination with Legal and Procurement  Getting Started: Tools You Can Use  You don’t need a custom platform to get going. Some automation options include:  GRC/TPRM platforms  with contract modules   Contract lifecycle tools  (e.g., Ironclad, LinkSquares, DocuSign CLM)  Workflows in MS365 or Google Workspace  using reminders and task lists  Low-code platforms like Airtable or Monday.com for custom trackers    Key Takeaways:  Contracts are a goldmine of risk and performance data. Don't let them sit untouched.  Automating reminders and tracking obligations keep your third parties accountable and your TPRM program compliant.  Start small: even a shared tracker with auto-reminders can reduce missed deadlines and drive savings.  Author Bio Heather Kadavy Senior Membership Success Coordinator Heather Kadavy  joined the Third Party Risk Association (TPRA) in 2023 as the Senior Membership Success Coordinator. In recent year(s) Heather has been providing freelance TPRM consulting work to various organizations after retiring from a Nebraska financial institution after nearly 35 years where she oversaw and managed critical programs of the organization including Third Party Risk Management, Information Security, Physical Security, Safety, Business Recovery, Financial Crimes, Model Risk Management, and Enterprise Risk Management.  In her TPRM role she had oversight of over a thousand third party relationships, systems, due diligence reviews and contract management activities.  She developed, facilitated, and implemented training programs for thousands of employees over the years. Heather is a natural born connector of people and values relationship building at the cornerstone of her career.  She encourages you to connect with TPRA and herself via LinkedIn to join in the "TPRM Global Conversation".

In the early morning of October 20, 2025, Amazon Web Services, the backbone of much of the modern internet, experienced a widespread outage in its Northern Virginia region. Within hours, popular apps, business platforms, and government services began to slow or fail. By evening, AWS reported that services were operating normally, with some backlogs clearing after that. This was not some minor hiccup. It took much of the day to resolve, and by the time systems steadied, the outage had already reminded everyone how deeply daily life depends on the same shared foundations.  The Impact  The outage originated in AWS’s US-EAST-1 region, which supports a significant portion of global cloud activity. That single region underpins countless tools and services used every day by businesses, governments, and consumers alike. Well-known platforms such as Zoom, Venmo, and Alexa saw interruptions, but the effects reached much farther than that.  For many organizations, the disruption was one step removed. Their own systems appeared stable, yet vendors or downstream providers that relied on AWS began to falter. Even companies with no direct contract felt the slowdown through partners and service integrations that quietly depend on the same infrastructure.  The Cause  AWS said the incident stemmed from DNS resolution issues that affected DynamoDB service endpoints in US-EAST-1, and they began mitigation after identifying the problem ( AWS update ). In parallel, traffic health checks did not behave as expected, which complicated rerouting and recovery. The combination created a chain of disruptions that took most of the day to unwind.  In short, one lookup broke, one database stalled, and everything built on top of them learned what “shared dependency” really means.   The Response  AWS posted regular updates, isolated the DNS issue, and restored service, with some queues taking longer to clear. By evening, operations were mostly normal.  AWS confirmed that the outage was not the result of a cyberattack  and said a detailed incident analysis would be released. The company’s updates through its status page and social channels provided transparency but were highly technical, which made it difficult for non-technical teams to interpret and share meaningful updates inside their organizations .   What This Illustrates About Concentration Risk  This was concentration risk in practice, too much dependency in one place. The AWS US-EAST-1 region is popular because it is large, efficient, and cost-effective. That popularity concentrates demand, which can magnify impact during an incident.  When multiple organizations and their vendors depend on the same region, a single problem can become a multi-industry event. Many companies that felt diversified discovered their vendors were sitting on the same underlying infrastructure.  What It Reveals About Fourth- and Nth-Party Risk  Even companies far removed from AWS saw disruptions. That is extended vendor risk, where your vendor’s vendor, or their vendor’s vendor, fails and causes impact for you.  A payment platform might use AWS directly, while your billing software depends on that platform. Your HR system’s analytics add-on might sit on AWS even if the core platform does not. The farther down the chain the issue occurs, the harder it is to see, yet the business effect is the same.  The Broader Lesson: Shared Infrastructure Means Shared Consequences  Cloud services and computing have made business faster and more connected. It has also made it interdependent. When one provider falters, entire industries can feel the shock.  Technical events become business events quickly. Disruptions affect customer access, transactions, revenue, and regulatory expectations. For TPRM programs, resilience is not about predicting every outage. It is about understanding dependency risk and being ready to respond calmly when it appears.  What TPRM Practitioners Should Be Doing Now  The AWS outage was a free stress test. Even if your organization stayed upright, it showed how much depends on a handful of cloud providers. Now it’s time to turn awareness into action.  1. Revisit your dependency map   Trace your direct, fourth-party, and nth-party exposure. You do not need to document every sub-vendor, but you should know where critical systems live and who connects them.  Review your direct vendors and note hosting provider and region.  Identify shared dependencies across your portfolio.  Flag any service that leans on a single region.  Share this with cybersecurity and IT partners to align contingency plans.    2. Strengthen collaboration between TPRM and Cybersecurity/Information Technology  When an outage hits, both perspectives are essential.  Cyber professionals (which may include the incident response team) focus on the how, root cause, technical exposure, and data integrity.  TPRM focuses on the so what, business impact, vendor accountability, and continuity of services.  Confirm with IT which systems can run from more than one location. Confirm with TPRM which vendors must maintain uptime and notify you. If this partnership is informal, formalize a simple workflow that defines who watches vendor status, how alerts move to business leaders, and who decides when to communicate with executives or customers.  3. Update due diligence and contracting  Bake resilience into every step of the vendor lifecycle.  During due diligence   Ask where systems are hosted, including backup regions.  Require disclosure of key sub-vendors such as cloud hosts and data processors.  Confirm that failover is tested and recent.  Check that downtime tolerance matches your business needs.  In contracts   Add notification timelines for incidents that affect your data or operations.  Require vendors to maintain and test continuity and disaster recovery plans on a regular basis (at least annually).  Define how credits or remedies apply during regional incidents.  Include data portability and exit terms so you can migrate if reliability declines.  For existing contracts, capture this through an addendum or vendor questionnaire. The goal is alignment between your expectations and actual capabilities.  4. Treat vendor resilience as an ongoing metric  Do not let resilience live in a one-time questionnaire.  Track uptime and incident response quarterly.  Watch how vendors communicate during industry-wide disruptions.  Follow up with any vendor that takes more than a business day to confirm whether they were affected.  Transparency and communication matter as much as uptime.  5. Bring the lesson to leadership  Executives and boards care about continuity, not DNS details. Use this event as a case study.  Keep it in business terms.  How long could you operate if your main region failed?  Which vendors share that region?  How long does recovery actually take in hours, not in theory?  Boards and regulators should already be asking about cloud concentration and systemic risk. Showing mapped dependencies and credible plans signals maturity and foresight.  Not Ready for All That Yet? Try This Instead  If your program is not ready for the full list above, start smaller. A one-hour tabletop can surface the most important gaps before you redesign your program.  A One-Hour Tabletop: “When the Cloud Falters”  Scenario:  Your most important customer-facing service is degraded for six hours because your cloud provider’s main region is down.  Prompts:   What fails first, and who notices?  Who owns communication with leadership and customers?  What do you tell executives in the first 30 minutes?  What data confirms whether the issue is internal or supplier-related?  If the outage lasts more than four hours, how do you continue operations?  When and how do you tell customers you are stable again?  What good looks like:   Clear ownership of communication and impact analysis.  Named roles for executive updates and recovery coordination.  A realistic recovery time, not a guess.  Two improvement items assigned for follow-up within 30 days.  Start here. Capture where confusion happens and what slows decisions. The results will show you where to strengthen communication, contracts, and coordination next.  Conclusion   The AWS outage was not just about downtime. It was about concentration risk and dependency, and how quietly it grows until something forces everyone to see it. What looked like one point of failure was really a network of shared reliance across vendors, industries, and geographies.  For TPRM professionals, the lesson is to stop treating concentration as abstract and start treating it as operational reality. Every vendor, every contract, and every dependency tells part of that story. The work ahead is not to eliminate risk, it is to ensure that when one link breaks, which it inevitably will, the rest of the chain holds.  Additional Resource Explore our certificate, Securing SaaS Applications: A Comprehensive Approach to Cloud Risk Management , which provides an in-depth look at evaluating and managing risks associated with cloud-based SaaS solutions. Author Bio Hilary Jewhurst Sr. Membership & Education Coordinator at TPRA Hilary Jewhurst  is a seasoned expert in third-party risk and risk operations, with nearly two decades of experience across financial services, fintech, and the nonprofit sector. She has built and scaled third-party risk programs from the ground up, designed enterprise-wide training initiatives, and developed widely respected content that helps organizations navigate regulatory complexity with clarity and confidence. Known for turning insight into action, Hilary’s thought leadership and educational work have become go-to resources for professionals looking to mature their TPRM programs. She regularly publishes articles, frameworks, and practical guides that break down complicated risk topics into meaningful, accessible strategies. Hilary recently joined the  Third Party Risk Association (TPRA)  as a staff member, supporting industry-wide education, peer learning, and advancing best practices. She is also the founder of  TPRM Success , a boutique consultancy that helps organizations strengthen their third-party risk management capabilities through targeted training, tools, and strategic guidance.

When a vendor relationship ends, the risk doesn’t.  Too often, vendor offboarding is treated as an afterthought, left to chance, split between departments, or buried in a never-used checklist. The problem? An incomplete or inconsistent termination process exposes your organization to some of the highest risks in the TPRM lifecycle.   These risks include, but are not limited to, access that was never revoked, assets that were never returned, and/or data that was never deleted.  The good news: these risks are avoidable, and automation can help.  Why Offboarding Matters More Than You Think  In many organizations, onboarding gets all the attention, due diligence, approvals, kickoff meetings, and security reviews.  But what about the end of the relationship?  "You wouldn’t let an employee walk out the door without collecting their badge and shutting off system access. Why do we do it with vendors?"   Poor offboarding can lead to:  Lingering system access and potential unauthorized activity  Unreturned data or devices , especially in hybrid/cloud environments  No formal record of what actions were completed or by whom  Compliance gaps if data disposal or security controls were contractual  The Automation Opportunity  Here’s where automation can drastically improve vendor offboarding, making it faster, repeatable, and auditable.  1. Triggering the Offboarding Workflow Automatically  When a contract is marked as terminated or not renewed, the system will kick off automated offboarding activities.  It can route these activities to IT, InfoSec, Procurement, and TPRM automatically.  Tool tip: Use a trigger from your TPRM tool, GRC system, or contract lifecycle platform to launch this sequence.    2. Auto-Assigning Offboarding Tasks  Such offboarding tasks can include, but are not limited to:  Revoking system access and credentials  Collecting physical or virtual assets  Confirming data destruction or secure transfer  Archiving vendor risk files and workpapers  Tool tip:  Use tools like ServiceNow, Jira, or Monday.com to assign tasks and track completion status in real time.    3. Generating & Storing Offboarding Evidence  The system can require documentation uploads or confirmations (e.g., screenshot of deprovisioned access, destruction certificates) of completed offboarding tasks  It can also store all evidence in the third party profile for audit purposes  Tool tip:  Attach offboarding steps to a third party profile in your TPRM platform or centralize storage in a secure SharePoint folder.    4. Post-Termination Reviews  Set up a short internal review form to capture any final third party risks or lessons learned.  Optionally trigger a survey to business owners to assess third party performance.  Update the third party’s profile to note if the third party can be used again or if it is recommended to not do business with the third party.  Tool tip: Use Microsoft Forms or Google Forms and auto-send based on the third party status change.  Real-World Example: Offboarding Automation at a Global Fintech  A fintech company with over 1,200 third parties discovered that more than 30% of “inactive” third parties still had some form of residual access, including access to shared cloud folders and legacy single sign-on (SSO) profiles.  The organization then implemented a third party offboarding checklist built into their TPRM platform, which auto-triggered when a contract end date was reached or when a business owner marked a third party as "no longer in use."  Each task, such as deprovisioning access, collecting assets, confirming data deletion, was auto-assigned to pertinent stakeholders with deadlines and owner accountability.  Results in the first 6 months:   Reduced open-access risk by 78%  100% of offboarding steps documented and accessible for audits  Gained stronger alignment between TPRM, InfoSec, and Procurement  Getting Started: Questions to Ask  Do we have a standard offboarding checklist for third parties?  Who owns each task, and how do we know the tasks were completed?  Can we identify all third parties with system access that may still be active post-contract?  Do we store evidence of data destruction or handover?    Quick Win to Try  Start by creating a centralized third party offboarding checklist with due dates and owner fields. Even if you use Excel or a Google Form at first, link this to third party termination triggers and build consistency from there.  Then, explore how your existing tools (TPRM platform, ticketing system, workflow automation) can formalize and automate the process.    For additional information on the third party Termination process, view TPRA’s TPRM 101 Guidebook.   Author Bio Heather Kadavy Senior Membership Success Coordinator Heather Kadavy  joined the Third Party Risk Association (TPRA) in 2023 as the Senior Membership Success Coordinator. In recent year(s) Heather has been providing freelance TPRM consulting work to various organizations after retiring from a Nebraska financial institution after nearly 35 years where she oversaw and managed critical programs of the organization including Third Party Risk Management, Information Security, Physical Security, Safety, Business Recovery, Financial Crimes, Model Risk Management, and Enterprise Risk Management.  In her TPRM role she had oversight of over a thousand third party relationships, systems, due diligence reviews and contract management activities.  She developed, facilitated, and implemented training programs for thousands of employees over the years. Heather is a natural born connector of people and values relationship building at the cornerstone of her career.  She encourages you to connect with TPRA and herself via LinkedIn to join in the "TPRM Global Conversation".

In today’s increasingly interconnected enterprise landscape, third-party vendors are no longer just peripheral—they are central to how organizations operate, deliver value, and respond to change. Despite their critical role, many companies lack a clear understanding of how these external relationships align with strategic goals, operational dependencies, and risk tolerance. This lack of visibility can leave organizations vulnerable to disruption, inefficiency, and unmanaged risks. One of the most effective tools for closing this gap is the business capability map—a structured representation of what the business does to create value. When enriched with vendor, contract, and procurement data, this map shifts from a planning artifact into a strategic framework for enterprise resilience.  A business capability map outlines the core functions of an organization independently of its structure, technology, or processes. It offers a stable view of what the business can do—such as “Customer Onboarding,” “Revenue Management,” or “Supply Chain Visibility”—regardless of how those capabilities are currently implemented. This abstraction is powerful because it enables leaders to focus on what the business needs to accomplish, rather than how it does it. When third-party vendors are mapped to the capabilities they support, the organization gains a clear, contextual understanding of external dependencies. This mapping shows which vendors are connected to specific business functions, identifies redundancies or gaps, and illustrates how vendor relationships affect operational resilience.  The value of this approach becomes especially clear when viewed through the lens of risk awareness and resilience analysis. For example, if a single vendor supports a mission-critical capability like “Data Protection,” the organization may face a concentration risk. Conversely, if multiple vendors support the same capability without a strategic reason, it could indicate vendor sprawl—an inefficiency that can weaken accountability and add complexity. By visualizing these relationships, organizations can identify where intentional redundancy is necessary for resilience and where consolidation could lower risk and cost.  This capability-vendor mapping also supports more strategic decision-making. Leaders can pose targeted questions such as: Are high-risk vendors supporting high-value or mission-critical functions? Are there capabilities without vendor support, indicating over-reliance on internal resources or potential single points of failure? Do current contracts and procurement strategies align with the organization’s future capability roadmap and resilience objectives? These questions help shift the focus from reactive vendor management to proactive resilience planning.  The advantages of this approach are clear. For example, during a vendor outage or cybersecurity incident, the capability map helps teams quickly determine which business functions are affected and prioritize response efforts. During periods of organizational change—such as mergers, acquisitions, or digital transformation—the map offers a stable reference point for evaluating vendor dependencies and maintaining continuity. Procurement teams can use the map to negotiate contracts that include resilience clauses, like service-level guarantees, disaster recovery provisions, and data portability. Business owners gain clarity on which capabilities are externally supported and can plan accordingly for performance, continuity, and scalability.  Building and maintaining this resilience-focused capability map requires collaboration among several key roles. Third-party risk managers contribute insights into vendor criticality, exposure, and compliance. Business owners provide operational context and performance expectations. Procurement teams align sourcing strategies with business priorities and resilience objectives. And business architects ensure the capability framework remains accurate, relevant, and adaptable to future needs. Together, these stakeholders create a shared understanding of how external relationships support the business—and how those relationships can be optimized for resilience.  Ultimately, mapping third-party vendors to business capabilities is more than just a technical task—it’s a strategic necessity. It enables organizations to manage complexity confidently, reduce risk, and build a more resilient enterprise. By defining ownership, dependencies, and risks across the capability landscape, businesses can make better decisions, respond more effectively to disruptions, and ensure that external partnerships support long-term strategic objectives.  Author Bio Keith Stouder VP, Data Privacy and Protection Keith Stouder is an experienced executive with over 30 years of experience in enterprise architecture, data privacy, and security. He began his career in state procurement, where he handled complex technical RFPs, and has established a notable record in third-party risk management (TPRM), successfully launching two TPRM programs and developing two others. Keith consistently takes a strategic and practical approach to balancing risk with business value. He currently serves as Vice President of Data Privacy and Protection at ACT, Inc. , where he leads a cross-functional, innovative team focused on using automation and AI to enhance third-party due diligence and streamline the vendor approval process. Keith ensures that vendor value is delivered throughout the contract lifecycle—managing vendors both individually and as part of the broader enterprise portfolio. Through strategic oversight of vendors and applications, he aligns portfolio management with business goals to maximize operational and financial impact.

Most TPRM programs start risk management after the contract is signed, or worse, after the third party is already active.  But by that point, you're already behind.  The best TPRM teams are shifting left, embedding automation into the intake and triage process to capture the right information, assign the right risk level, and route the right review at the very start.   Done right, intake automation helps you:  Stop sending redundant questions to the third party  Avoid missed high-risk third parties  Improve turnaround time  Make procurement and business units your partners, not your adversaries  The Intake Problem   Manual third party intake often looks like this:  Business user of the third party product/service emails TPRM team: “Can we use this third party?”  TPRM team asks for a basic description of products/services that will be offered  A general questionnaire is sent (regardless of third party type or data sensitivity)  Multiple follow-ups and clarifications are performed  Everyone’s frustrated  This is inefficient and does not take into account a risk-based approach. Low-risk third parties get over-scrutinized, and high-risk third parties may slip through the cracks.  What You Can Automate   Let’s look at how automation can transform intake into a structured, repeatable process that gathers key risk insights and triggers the right next steps, without creating bottlenecks.   1. Smart Intake Forms  Use an online form (e.g., in your GRC, TPRM platform, or tool like Microsoft Forms) that business users fill out   before  engaging with a third party.  Questions to include:  What services will the third party provide?  Will they access customer data or company systems?  What types of data will be accessed (PII, PHI, PCI, IP)?  Where will the services be delivered from?  What’s the contract value or term length?  Is this third party replacing an existing one?  Tool Tip : Conditional logic can adjust questions based on prior answers, keeping the form short and relevant.    2. Automated Risk Triage  Based on responses, route the request into the appropriate track:  No Risk Identified → auto-approved or documented as "informational only"  Low Risk → minimal questionnaire or policy acknowledgment  Moderate Risk → standard due diligence questionnaire sent  High Risk  → full risk review, possibly including legal, compliance, and InfoSec reviews  Tool Tip:  Some TPRM Tools allow auto-routing of intake requests based on logic trees.  3. Trackable Intake Queue   Turn intake into a visible, trackable pipeline, not a buried inbox.  You should be able to see:  How many new third parties are awaiting review  What tier each has been assigned  What due diligence is pending or complete  Who “owns” the next step  Tool Tip: Use Trello, Jira, Monday.com , or a built-in TPRM dashboard to manage this visually if your TPRM system doesn't already.    4. Integration with Procurement or Legal Workflows   Make intake the bridge between procurement, legal, and risk, not a roadblock.  Connect your intake system to:  Contract review tools  E-signature platforms (e.g., DocuSign)  Purchase request systems  Procurement tools (e.g., Coupa, SAP Ariba)  Bonus : Add a “TPRM clearance” checkbox in your procurement tool so teams can’t finalize deals without routing through risk mitigation activities.    Real-World Example: Intake Transformation at a Healthcare Provider   A large healthcare company implemented a smart intake form tied to its procurement request portal. The form automatically tiered third parties and launched tailored workflows based on services, data access, and regulatory flags.  Results:  3x faster intake processing time  100% of high-risk third parties flagged before a contract was signed  70% reduction in unnecessary reviews for low-risk third parties  Business stakeholders started submitting requests earlier in the process  Getting Started  Here’s how you can start automating intake and triage:  Map what you want to know up front (data access, geography, system access, business impact)  Build a simple intake form, even in Google Forms or Microsoft Forms if you do not have a TPRM platform  Create decision logic to assign a risk tier based on responses  Route the third party to the appropriate review workflow  Track the intake queue so nothing falls through the cracks    Pro Tip: Make Intake the Gateway, Not the Gatekeeper  Your intake process should empower business stakeholders with clarity and speed, not add layers of friction. Automation allows you to deliver fast “yes/no/how” answers, making it easier to get the right third parties in the door and ensure risky ones are on your radar.    Key Takeaway  Automating intake and triage ensures that TPRM starts at the right moment, with the right information, and the right level of scrutiny is provided. It protects your organization while speeding up business decisions.    Author Bio Heather Kadavy Senior Membership Success Coordinator Heather Kadavy  joined the Third Party Risk Association (TPRA) in 2023 as the Senior Membership Success Coordinator. In recent year(s) Heather has been providing freelance TPRM consulting work to various organizations after retiring from a Nebraska financial institution after nearly 35 years where she oversaw and managed critical programs of the organization including Third Party Risk Management, Information Security, Physical Security, Safety, Business Recovery, Financial Crimes, Model Risk Management, and Enterprise Risk Management.  In her TPRM role she had oversight of over a thousand third party relationships, systems, due diligence reviews and contract management activities.  She developed, facilitated, and implemented training programs for thousands of employees over the years. Heather is a natural born connector of people and values relationship building at the cornerstone of her career.  She encourages you to connect with TPRA and herself via LinkedIn to join in the "TPRM Global Conversation".

If a third party, or their key executives, were added to a sanctions list tomorrow, how quickly would you know?  If your answer includes words like “manual process,” “periodic check,” or “we probably wouldn’t,” you’re not alone.  But in today’s geopolitical climate, real-time sanctions and watchlist screening isn’t a nice-to-have, it’s a regulatory and reputational must-have. And thankfully, it’s one of the most automation-ready functions in your Third Party Risk Management (TPRM) toolbox.  The Growing Sanctions Landscape  Governments and global bodies update sanctions and enforcement lists frequently, sometimes daily. These include:  OFAC (U.S. Treasury Department)  EU & UK Sanctions Lists  UN Sanctions List  State-level or regional enforcement databases  But what can happen if you are not actively and continually ensuring your third parties, or their executives, are not on a sanctions list?  Inaction or delayed detection can result in:  Civil or criminal penalties  Loss of government contracts  Reputational harm and media exposure  Regulatory investigations for due diligence failures  This isn’t theoretical. There are documented cases of companies continuing to work with blacklisted entities because the list was checked “once, at onboarding.”  Where Automation Fits In  Automated screening ensures you aren’t relying on point-in-time checks or someone’s memory to flag a critical compliance issue.  Here’s how it works:  1. Continuous Third Party Monitoring  Third Parties are screened continuously against real-time or nightly updated watchlists  If a match is found, it automatically triggers alerts and escalations  Tool Tip:  Many due diligence and TPRM platforms integrate with data providers like Dow Jones, Refinitiv, World-Check, or LexisNexis for live list monitoring.    2. Executive & Beneficial Ownership Checks  Automation isn’t just about third party names. It also scans key individuals tied to the third party (owners, board members, executives) for matches  Tool Tip: Use enhanced due diligence services or APIs that enrich third party profiles with corporate family trees and UBOs (ultimate beneficial owners).  3. Auto-Flagging and Escalation Workflows  Matched entries can be routed to TPRM or compliance teams for review  You can configure risk scores to increase automatically or trigger an urgent reassessment if a third party is flagged  Tool Tip: Use case management tools to document investigation steps, outcomes, and decisions for audit-readiness.  Real-World Example: Catching a Sanctions Match Before It Went Public  A pharmaceutical company’s TPRM team was using automated sanctions monitoring tied to their third party master file. When a supplier’s parent company was added to the OFAC list, the system flagged the match immediately, even though the supplier’s name hadn’t changed.  “If we had waited for the quarterly vendor review, we would’ve missed it, and been in violation,” said their Director of Compliance.   They paused all spend, conducted a rapid risk and legal review, and replaced the third party, all documented through an automated case workflow.    What to Monitor Automatically  Here’s what should be in your automation scope:  Data Type Example Vendor Name Acme Global Services LLC Parent / Subsidiary Orgs Acme Holdings Inc. Ultimate Beneficial Owners John Doe, 51% Stake Key Contacts/Executives Jane Smith, CFO Country of Registration Vendors in embargoed nations How to Get Started  You don’t need a complex setup. Start with:  Free tools:  OFAC’s online SDN check tool or World Bank debarred list  Subscription databases: World-Check, Refinitiv, LexisNexis, or Sayari  API integration: Tie real-time alerts into your TPRM platform or workflow engine (Zapier, Workato, etc.)    Key Takeaways  Sanctions and watchlist screening shouldn’t be a “once and done” task.  Automation helps you stay in compliance without increasing manual workload.  Screening third parties and their principals continuously is essential for managing modern regulatory risk.   Author Bio Heather Kadavy Senior Membership Success Coordinator Heather Kadavy  joined the Third Party Risk Association (TPRA) in 2023 as the Senior Membership Success Coordinator. In recent year(s) Heather has been providing freelance TPRM consulting work to various organizations after retiring from a Nebraska financial institution after nearly 35 years where she oversaw and managed critical programs of the organization including Third Party Risk Management, Information Security, Physical Security, Safety, Business Recovery, Financial Crimes, Model Risk Management, and Enterprise Risk Management.  In her TPRM role she had oversight of over a thousand third party relationships, systems, due diligence reviews and contract management activities.  She developed, facilitated, and implemented training programs for thousands of employees over the years. Heather is a natural born connector of people and values relationship building at the cornerstone of her career.  She encourages you to connect with TPRA and herself via LinkedIn to join in the "TPRM Global Conversation".

If you’re still relying on spreadsheets, shared drives, or email threads to collect due diligence evidence from third parties, you're not alone.  But you’re also probably:  Spending too much time sending reminders  Missing key artifacts come audit season  Duplicating efforts across assessments  Struggling to prove historical compliance  This is a ripe area for automation, one that can immediately ease TPRM fatigue and strengthen audit readiness.     The Evidence Burden is Real  In today’s TPRM environment, third parties are expected to provide dozens of artifacts, often across multiple frameworks or request types:  SOC 2 or ISO 27001 reports  Cybersecurity policies & control assessments  Insurance certificates  Penetration test summaries  Business continuity plans  Signed attestations  It’s a lot and often scattered. Multiply that by 50, 200, or 1,000 vendors, and suddenly your risk team is a full-time document chaser.  The Automation Opportunity  Here's how automation can modernize your evidence collection process, reduce back-and-forth, and give you better visibility into what's complete, and what's missing.     1. Auto-Send Evidence Requests on Schedule or Trigger  Set your TPRM application to automatically send evidence requests based on:  Vendor onboarding  Contract renewal dates  Annual or semi-annual reassessment cycles  Triggered events (e.g., scope changes or security alerts)  Tool Tip: TPRM platforms like Mirato, ProcessUnity, or Aravo can generate evidence requests tied to vendor risk tier and lifecycle stage.     2. Use Pre-Built Templates and Smart Forms  Build or reuse standardized templates by risk type or assessment purpose (e.g., privacy, InfoSec, ESG)  Use dynamic forms that adjust based on vendor responses to avoid over-requesting  Tool Tip: Tools like OneTrust or Venminder, an Ncontracts Company enabled conditional logic in assessments to streamline collection.    3. Centralize and Auto-Categorize Submissions  Route uploaded documents directly into the correct vendor profile and artifact folder  Use metadata to label evidence by type (e.g., SOC 2, PCI cert), date, and expiration  Tool Tip: Integrate SharePoint, Google Drive, or your TPRM platform’s document library with automation tags for search and retrieval.     4. Track Expirations and Send Auto-Reminders  Set calendar-based reminders before a certificate or report expires  Automatically notify both internal stakeholders and vendor point of contacts (POCs)  Tool Tip:  Use Power Automate, Zapier, or ServiceNow to flag expiring evidence and send personalized nudge emails.    5. Map Evidence to Controls or Frameworks  Auto-tag evidence to align with relevant controls (e.g., NIST CSF, ISO 27001, CAIQ)  Allow auditors or regulators to view which evidence supports each control  Tool Tip: Use tools with compliance mapping capabilities like AuditBoard, LogicGate, or TrustCloud.  Real-World Example: How a Mid-Sized Bank Reduced Audit Chaos  A regional bank with over 350 vendors had been relying on Excel trackers and shared folders to manage third party evidence. Every audit cycle brought panic, re-requests, and unclear ownership.  They introduced automated workflows that:  Sent initial evidence requests 90 days before renewal  Tracked which vendors responded and what was missing  Auto-tagged files by control area  Alerted internal teams if a document was expired or missing  Result:  85% reduction in last-minute evidence scramble  100% audit-ready vendor files  50+ hours saved per quarter    Getting Started with Evidence Automation  You don’t need a full GRC overhaul to get going. Start small with:  Standardized email templates for reminders  A centralized intake form for vendors to upload files  A shared dashboard to track evidence status by vendor or category  Then build toward automation and integration with your TPRM, GRC, or document management tools.  Pro Tip: Ask for Evidence Once. Use It Many Times.  Good automation also means good reuse. Store and tag documents so you’re not asking for the same SOC report for every new engagement.    Key Takeaway  Chasing down evidence is not a good use of your team’s time, or the vendor’s. Automating the collection, tracking, and expiration process saves effort, reduces errors, and strengthens your TPRM program’s credibility.   Author Bio Heather Kadavy Senior Membership Success Coordinator Heather Kadavy  joined the Third Party Risk Association (TPRA) in 2023 as the Senior Membership Success Coordinator. In recent year(s) Heather has been providing freelance TPRM consulting work to various organizations after retiring from a Nebraska financial institution after nearly 35 years where she oversaw and managed critical programs of the organization including Third Party Risk Management, Information Security, Physical Security, Safety, Business Recovery, Financial Crimes, Model Risk Management, and Enterprise Risk Management.  In her TPRM role she had oversight of over a thousand third party relationships, systems, due diligence reviews and contract management activities.  She developed, facilitated, and implemented training programs for thousands of employees over the years. Heather is a natural born connector of people and values relationship building at the cornerstone of her career.  She encourages you to connect with TPRA and herself via LinkedIn to join in the "TPRM Global Conversation".

You’ve built the framework. Defined the roadmap. Clarified the policies, procedures, and objectives. Now, the spotlight is on the final act before execution: the Budget .  Presenting a Third Party Risk Management (TPRM) budget isn’t just a numbers game, it’s a strategic dialogue with your C-suite. Each leader sees risk through a different lens. Your job is to make sure TPRM isn’t seen as a cost center, but as a business-critical function that protects brand value, operational continuity, and long-term growth.  When you step into the room, or join the Zoom, come prepared not only with accurate data, but also with a tailored approach that speaks each executive’s language when presenting your TPRM budget proposal.  Below is a sample budget submission  for a Third Party Risk Management (TPRM) program using estimated figures for a mid-sized organization  with around 1000 third parties , 20% of which are high or critical risk. This submission can be tailored for formal budget meetings, especially when speaking to a C-suite audience.  Sample Budget Example: TPRM Budget Submission: FY2026    Prepared by:  TPRM Program Office/Officer  Submitted to : Executive Leadership Team (CEO, CFO, CRO, CIO, COO, & CMO)  Date: June 6, 2025  Program Scope:  Covers third party onboarding, due diligence, ongoing monitoring, issue remediation, and exit/termination processes across 1000 third parties.  Executive Summary   This budget supports the implementation and maturity growth of our Third Party Risk Management (TPRM) program. It is designed to mitigate increasing third party risk exposure while enabling operational efficiency, regulatory alignment, and long-term resilience.  After aligning our budget with peer business units (e.g. IT, Procurement, etc.) to ensure no overlapping, we are requesting $1,240,000 in total TPRM program funding for FY2026, broken into the categories below.  TPRM Budget Breakdown  Category Detail Estimated Cost (USD) Personnel 3 FTEs (Manager, Analyst, Coordinator) + 1 contract assessor $450,000 Automation/Tools TPRM automation platform (e.g. onboarding, workflow, risk rating, etc.) $225,000 Training & Certification 3 staff attending TPRM conference & obtaining or maintaining certifications $15,000 Consulting Services External maturity model assessment and roadmap facilitation  $50,000  Operations Supplies, licenses, report, software, translation of vendor assessments $10,000 Travel   Site visits to top 10 critical third parties  $20,000 Risk Monitoring Services Third party financial, cyber, ESG monitoring subscriptions $150,000 Contingency Reserve For incident response or unplanned third-party reviews  $50,000 Program Development Internal awareness campaigns, playbook updates, policy refresh $25,000 Total   $1,240,000 Maturity Model Alignment  This budget enables us to progress from a TPRM Level 2 “Defined” to TPRM Level 3 “Integrated” maturity in the next 12 months. We will formalize our processes, integrate toolsets, and implement real-time monitoring with key risk indicators.  Supporting Attachments [Exhibit A-E]  Risk Appetite & Control Gap Analysis  Financial Risk Avoidance Estimator  Industry Peer Benchmarking  Sample ROI from Process Automation  5-Year Third Party Incident Tracker (Regulatory + Financial Impact)  TPRM to Corporate Alignment  This budget aligns to each of our organization’s six corporate goal:  Strategic Enablement  Risk Avoidance ROI  Risk Appetite Alignment  Efficiency Gains  Cyber & Operational Resilience  Brand Protection & ESG  As CEO,  I recognize one of your primary goals is Strategic Enablement :  Supporting secure scaling of partnerships, M&A, and outsourcing  Demonstrating proactive governance and leadership integrity    “As such, here is how TPRM aligns with our enterprise strategy and growth trajectory."    Every initiative in this budget supports not just compliance, but resilience and reputation. If we want to expand into new markets, partner with innovative vendors, and build customer trust, we must ensure that our third parties don’t introduce vulnerabilities. This budget enables proactive oversight that protects our ability to scale with confidence.    As CFO,  I recognize one of your primary goals is Risk Avoidance ROI :  Helping to avoid regulatory fines averaging $1.4M per incident (source: IBM/Ponemon)  Automate savings of ~$100K/year in reduced manual review hours    "So, Let’s talk about cost avoidance and value protection."    TPRM doesn’t generate revenue, but it shields it. Consider the financial impact of a third party data breach, regulatory fine, or supply chain disruption. We’ve included an incident impact analysis and a financial risk mitigation model. Tools like automation platforms may have upfront costs, but they reduce FTE hours and shorten due diligence cycles, providing long-term savings. This budget protects the bottom line.  As CRO: I recognize one of your primary goals is Risk Appetite Alignment:   Providing real-time risk visibility across 1,000 vendors  Improving response time to regulatory inquiries and audit findings    "As such, this is risk management at scale."    Our roadmap supports maturing the program to keep pace with emerging risks—cybersecurity, ESG, concentration, and geopolitical instability. With this budget, we gain visibility across the supply chain, build consistency in due diligence, and drive risk-informed decision making across the enterprise. Risk appetite isn’t just a principle, it’s operationalized here.    As COO:  I recognize one of your primary goals is Efficiency Gains :  Accelerating vendor onboarding timelines by ~30%  Reducing disruptions due to unknown vendor risks    "As such, TPRM budget plan enables operational efficiency and reduces friction."    Every tool and resource in this plan contributes to smoother onboarding, faster assessments, and fewer surprises post-contract. We’ve mapped resources to real operational demand, based on our third party portfolio’s inherent risk tiers. With the right investment, we reduce bottlenecks and improve our vendor lifecycle management without overburdening your teams.    As CIO: I recognize one of your primary goals is Cyber & Operational Resilience:   Detecting risk in data access and system integrations pre-contract  Supporting zero-trust third party architecture   "This budget strengthens our IT risk posture through third party visibility and integration support."   In today's interconnected ecosystem, our third parties don't just support the business, they connect to our systems, access sensitive data, and influence our security perimeter. This budget funds the tools and intelligence we need to proactively assess those relationships before they pose a risk.     Specifically, it supports:   A TPRM platform that integrates with ITSM and procurement tools for seamless intake and tracking  Ongoing cyber risk monitoring of vendors handling sensitive data or system access  Risk scoring tied to our internal architecture and controls, improving alignment with zero-trust and defense-in-depth strategies   By investing here, we’re ensuring that third party risks don’t undermine the protections we’ve worked so hard to build internally. It’s not just about compliance, it’s about maintaining system integrity, business continuity, and trust in our infrastructure.    We’re already seeing regulatory expectations shift toward shared accountability in third party breaches. This budget helps us stay ahead of those trends, and aligned with frameworks like NIST, ISO 27001, and the updated SEC guidance.    As CMO: I recognize one of your primary goals is   Brand Protection & ESG :   Assessing vendors for reputational risk, DEI, and ESG performance  Avoiding headline risk from third party failures    "We know that Brand trust is built on vendor integrity."  In a world where consumers and regulators scrutinize supply chains, a single third party misstep can create reputational headlines. Our TPRM budget supports robust assessments of vendors that touch customer data, brand experience, or ESG commitments. This is not only a risk measure, it’s a marketing safeguard.  Overall   What’s included in this Budget (and Why It Matters):   Resources: We’ve forecasted FTE and contractor needs to meet expected assessment volumes and maintain SLA targets.  Operations: This includes daily workflow support and practical tools to run an efficient program.  Training & Travel: To keep our team skilled and informed, and to support onsite reviews for critical third parties.  Maturity Investments:  We’ve aligned our asks to our current maturity level and the next step in our TPRM evolution.  Technology: We’ve assessed ROI for tools that reduce manual workloads and drive consistency.  We’ve also included benchmarking against peer organizations and a review of industry incidents and fines over the last five years to contextualize our ask. This isn’t “nice to have.” This is “mission critical.”    Bottom Line:   This is a proactive investment in resilience. It’s a shield for our brand, a hedge against regulatory and operational exposure, and a step toward a smarter, more scalable enterprise. I’m not just asking for budget, I’m asking for buy-in to protect what we’re building, the way we build it, and deliver it.   Author Bio Heather Kadavy Senior Membership Success Coordinator Heather Kadavy  joined the Third Party Risk Association (TPRA) in 2023 as the Senior Membership Success Coordinator. In recent year(s) Heather has been providing freelance TPRM consulting work to various organizations after retiring from a Nebraska financial institution after nearly 35 years where she oversaw and managed critical programs of the organization including Third Party Risk Management, Information Security, Physical Security, Safety, Business Recovery, Financial Crimes, Model Risk Management, and Enterprise Risk Management.  In her TPRM role she had oversight of over a thousand third par ty relationships, systems, due diligence reviews and contract management activities.  She developed, facilitated, and implemented training programs for thousands of employees over the years. Heather is a natural born connector of people and values relationship building at the cornerstone of her career.  She encourages you to connect with TPRA and herself via LinkedIn to join in the "TPRM Global Conversation".

If you’re sending the same full-blown risk assessment to every third party, whether they host sensitive data or simply mow your corporate lawn, it’s time for smarter automation.  Third Party tiering isn’t just a best practice, it’s a necessity. But too often, it’s handled manually or inconsistently, leading to:  Wasted time on low-risk third parties Insufficient scrutiny of high-risk partners  Frustration from internal teams and third parties alike  With automation, you can streamline how third parties are tiered, when they’re reassessed (i.e., their assessment cycle time), and whether they trigger enhanced due diligence, all without adding manual work.  Why Tiering Matters  Third Party tiering (or risk segmentation) helps you:  Prioritize time and resources  Tailor assessments based on risk  Justify lighter-touch reviews when appropriate  Align to internal policies and regulatory expectations  But the old way of doing it, with manual scoring, spreadsheet-based tiers, and ad hoc judgment, doesn’t scale. How Automation Improves Vendor Tiering & EDD  Let’s break this down into two key functions that benefit from automation:  1. Automated Vendor Tiering  Start by automatically assigning third party to tiers based on logic built into your intake or inherent risk assessment process.  Common inputs include:   Type and amount of data accessed (e.g., PII, PHI, cardholder data)  If the third party will access your organization's internal network and which environment (e.g., VPN, production environment)  Geographic presence or location of services  Regulatory exposure (e.g., HIPAA, GDPR)  Criticality to business operations    Tool Tip: Use intake forms or TPRM platforms that include conditional logic. Based on answers, third parties are automatically placed into Tier 1 (High), Tier 2 (Moderate), or Tier 3 (Low/Non-Critical).  Example Automation:   Business Owner selects “Yes” to the third party accessing customer PII → Platform sets them as Tier 1 → Full information security risk assessment initiated automatically.  2. Triggering Enhanced Due Diligence (EDD)  Once a third party is tiered, you can then set triggers to launch deeper reviews on a regular cadence, as well as if/when something changes.  EDD may include:   Expanded assessments Onsite or virtual visits Background checks on executives  Penetration testing evidence  Financial statement reviews  Crisis response documentation (e.g., BCP/DR tests)  Trigger Conditions Could Include, but not be Limited to:   A risk score threshold is exceeded  The third party is acquired by another organization and there is a change in leadership The third party will now host data offshore Contract change increases data access  Negative media or litigation is detected  Tool Tip: Connect monitoring platforms (BitSight, Security Scorecard, RiskRecon, Sayari) to your TPRM system to ensure events auto-trigger reassessment workflows.  Real-World Example: How a Tech Company Reduced Third Party Assessment Volume by 40%  A SaaS firm supporting fintech clients struggled with over-assessing third parties. Everyone received the same 200-question InfoSec review, whether they hosted client data or just helped with branding.  The organization decided to implement an automated tiering engine using a simple logic tree:  Tier 1: Hosts client data or business-critical systems → full TPRA Information Security Questionnaire + SOC 2  Tier 2: Indirectly supports regulated operations → limited questionnaire  Tier 3: No data access, non-critical → no further review  When a Tier 2 vendor’s risk rating system score dipped significantly, the system triggered an EDD workflow with an escalated assessment.  Results after 6 months:   40% fewer full assessments  Average assessment cycle time dropped 30%  Fewer third party complaints about irrelevant or overbearing reviews  What to Include in an Automated Tiering Framework  The TPRA community has created a free inherent risk questionnaire that can be leveraged within an automated tiering framework. If you are a TPRA member, you can obtain the inherent risk questionnaire template here . Getting Started  You don’t need to go from 0 to full automation in one step. Start with:  A basic inherent risk assessment that captures core risk drivers  A rules-based tiering system in Excel, Power Automate, or your TPRM tool  Clear definitions for Tier 1, 2, and 3, and what EDD should be performed for each tier Additional triggers for EDD (e.g., change in data access or poor cyber score)  Pro Tip: Automation Doesn’t Mean “Set and Forget”  You still need risk oversight. Automation just ensures your attention is focused on the third parties who need it most and when they need it most.     Key Takeaways  Treating all third parties the same is inefficient and risky  Automated tiering reduces noise and sharpens focus  Enhanced due diligence should be triggered by real risk, not just policies  You can implement this in phases with existing tools  Author Bio Heather Kadavy Senior Membership Success Coordinator Heather Kadavy joined the Third Party Risk Association (TPRA) in 2023 as the Senior Membership Success Coordinator. In recent year(s) Heather has been providing freelance TPRM consulting work to various organizations after retiring from a Nebraska financial institution after nearly 35 years where she oversaw and managed critical programs of the organization including Third Party Risk Management, Information Security, Physical Security, Safety, Business Recovery, Financial Crimes, Model Risk Management, and Enterprise Risk Management.  In her TPRM role she had oversight of over a thousand third par ty relationships, systems, due diligence reviews and contract management activities.  She developed, facilitated, and implemented training programs for thousands of employees over the years. Heather is a natural born connector of people and values relationship building at the cornerstone of her career.  She encourages you to connect with TPRA and herself via LinkedIn to join in the "TPRM Global Conversation".