Beyond the Checklist: Building a Unified Third-Party Control Framework
9:00 AM - 9:50 AM
The TPRM landscape has become a maze of overlapping mandates, standards, and stakeholder expectations, and a checklist alone can't get you through it. Navigating this landscape requires more than a checklist; it requires a strategic map. In this session, Jan Stappers provides a practical guide to building a control framework that flexes across risk domains rather than reacting to each new requirement in isolation. He'll explore how frameworks like ISO 37002 and ISO 31000 can serve as the architecture for a program that scales, regardless of which regulation, standard, or stakeholder is driving the requirement this quarter. Jan will demonstrate how to move beyond siloed responses to individual mandates and build a "Unified Control Framework" that holds up over time. Attendees will leave with a practical model for aligning third-party due diligence with shifting expectations, turning a fragmented compliance function into a genuine strategic advantage.
Key Takeaways:
The 2026 Landscape: A practical briefing on how expectations for reasonable due diligence are evolving and what that means for your program
Standards as the Foundation: Using ISO frameworks as the common architecture for navigating ambiguity across jurisdictions and stakeholders
Operationalizing the Framework: Practical tactics for integrating ESG, Cyber, and Ethics risk into a single third-party lifecycle
Speaker(s)
Jan Stappers
LL.M., PgD EVP, GRC Solutions Strategy
Mitratech Prevalent
Jan Stappers serves as EVP, Solutions Strategy at Mitratech. An authority in organizational whistleblowing management, data privacy, governance, risk management, and regulatory compliance, Jan contributed to the development of ISO 37002, the international guidance for whistleblowing management systems. He is a sought-after speaker on GRC-related topics and has authored numerous articles on legislative developments and organisational best practice. Jan is a Certified Information Privacy Professional (CIPP/E) through the International Association of Privacy Professionals (IAPP). He holds a Postgraduate Diploma (PGDip) in EU Competition Law from King’s College London and a Master of Laws (LL.M) in European Law from Leiden University. He is a member of the United Nations Economic Commission for Europe’s (UNECE) Working Party on Regulatory Cooperation and Standardization Policies, contributing to its Group of Experts on Risk Management in Regulatory Systems.