Artificial intelligence is transforming third-party risk from a compliance function into a strategic capability. The SVP, Head of Audit for a major international bank explains why continuous monitoring, ecosystem thinking and stronger governance are becoming essential as AI reshapes vendor risk across the financial services sector.
Banks can no longer treat third-party
risk management as a compliance exercise focused on periodic vendor reviews.
As artificial intelligence becomes
embedded throughout the technology supply chain, organizations must
fundamentally rethink how they identify, monitor and govern external risk.
Speaking at CeFPro's 2026 Risk
Americas conference the SVP, Head of Audit for a major international bank
argued that institutions should transform third-party risk management into a
strategic capability.
This, he said, should be supported by
continuous monitoring, specialist expertise and AI-powered intelligence if they
are to remain resilient in an increasingly interconnected ecosystem.
The executive explained that AI
presents a unique challenge because organizations cannot simply choose to avoid
it.
"We cannot say we're not going
to use this vendor because it is AI enabled. You don't have that option
available," he said. "So you have no choice but to use vendors with
AI embedded in them."
As a result, AI itself becomes an
unavoidable source of third-party risk that institutions must understand and
manage rather than avoid.
He argued that this represents a
decisive shift in the purpose of third-party risk management.
Historically, vendor oversight relied
heavily on spreadsheets, manual processes and reactive intervention after
problems had already emerged.
Following the financial crisis, firms
developed more formal governance, centralized vendor inventories and periodic
monitoring aligned with regulatory expectations.
Today, however, those approaches are
proving inadequate for an environment where AI-enabled vendors, cloud providers
and complex technology ecosystems evolve continuously.
The speaker described the industry as
approaching an inflection point where continuous intelligence replaces periodic
assessment.
Instead of annual reviews,
institutions should increasingly rely on integrated internal and external data
feeds, financial risk indicators, cyber intelligence, adverse media and
operational signals to produce near real-time vendor risk scoring and automated
alerts.
Looking further ahead, he envisaged
AI eventually predicting vendor failures, cyber incidents and compliance
breaches before they materialize, ultimately creating self-optimizing
third-party risk frameworks capable of monitoring vendor onboarding, performance
and remediation across entire supply chains.
That evolution, however, introduces
an entirely new collection of interconnected risks.
Traditional operational risk is
expanding into model and automation risk. Cyber threats increasingly involve
adversarial AI.
Data protection has become
inseparable from AI training practices, while third-party risk now extends well
beyond immediate suppliers into fourth-party and wider ecosystem dependencies.
The executive warned that
organizations are becoming increasingly dependent on shared cloud
infrastructure, common AI models and a relatively small number of technology
providers.
"One vendor relying on the same
AI processor or multiple vendors subject to the same geopolitical risk"
can create cascading failures that rapidly spread across interconnected
organizations, he explained.
Understanding those relationships,
rather than assessing vendors individually, will become one of the defining
capabilities of effective third-party risk management.
