display-middle-ads-here
Third-Party Risk Management (TPRM) is no longer a static compliance exercise.
Instead, it has evolved into a dynamic and multifaceted discipline requiring constant adaptation in order to keep pace with rapid change. And as we all recognize, in the highly regulated world of corporate finance, fast-moving targets always present unique challenges.
So, as regulatory landscapes shift and risks proliferate, just what will it take for financial institutions to refine their strategies and ensure the maturity of their TPRM programs measure up to those challenges?
In a recent CeFPro webinar, industry leaders Anne McGowan, Head of Supplier Management, Governance & Risk with Lloyds Banking Group, and Hilda Andeliz, Vice President & Enterprise Vendor Performance Analyst at Valley Bank in the US, shared their expertise on navigating the regulatory pressures of TPRM.
In today’s interconnected financial ecosystem, third-party risk management (TPRM) has become a cornerstone of operational resilience. Industry leaders like McGowan and Andeliz see both threat and opportunity in the requirement to oversee extensive and critical supplier networks.
"We've been on a journey developing our TPRM," McGowan explains. "But the real focus is building more strategic relationships with our most important suppliers."
Striking a balance between confidence and preparedness
A recurring theme in TPRM is the gap between confidence in existing systems and the reality of regulatory scrutiny. “Sometimes overconfidence comes from having a structured system in place without understanding if it's robust enough to withstand regulatory examination,” admits Andeliz, candidly.
She points out that many programs rely on static assessments rather than dynamic monitoring to adapt to evolving risks. “Defending a TPRM program requires ongoing oversight, up-to-date data, and senior leadership engagement. It’s more than having a nice framework; it’s about showing evidence of risk prevention and management,” she adds.
McGowan echoes this sentiment, emphasizing the importance of evolution: “TPRM cannot be static. Like a world-class athlete, you need consistent training and adaptation to maintain top performance. Programs must evolve to meet changing demands, new risks, and regulatory directives.”
Regulatory Deadlines and Urgency
Regulatory frameworks such as the EU’s Digital Operational Resilience Act (DORA) have added urgency to enhancing TPRM practices. While DORA’s prescriptive nature accelerates preparation, McGowan highlights a different driver: “Deadlines create urgency. In the UK, the upcoming critical third-party legislation is still principle-based, leaving firms to interpret and adapt. However, as deadlines approach, the pressure to comply intensifies.”
Andeliz underscores the importance of leadership in meeting these challenges: “In the U.S., the Department of Justice and the SEC’s activity have increased C-suite involvement. That’s key. Leaders need to allocate resources and ensure tools are used effectively to drive urgency and maturity in programs.”
