As regulatory pressures mount, Vendor Risk Europe revealed the disconnect between compliance and true operational resilience. DORA may be driving change, but financial institutions still grapple with siloed teams, outdated processes, and fragile vendor ov
display-middle-ads-here
In the solutions-focused, always-on age of tech-simplified
process and bite-sized information, it could be argued that third party risk management
has adopted some of the characteristics of a corporate counterculture.
Just as technology promises simplification and one-stop shop
solutions for customer-focused services like payments and account management,
back office functions in financial organizations find themselves mired ever
more deeply in increasingly complex and inter-connected regulatory and
compliance frameworks.
Growing reliance upon external vendors for everything from
cloud computing to customer service has expanded the scope and severity of risk
dramatically.
Regulatory frameworks like DORA are pushing firms to go
beyond static compliance and demonstrate active, real-time resilience. Yet many
organizations still struggle with fragmented oversight, inconsistent data, and
unclear accountability across risk, procurement, and IT.
Exit planning is often reactive, testing remains rare,
business engagement is inconsistent. Modern risk managers are expected to
battle not only an evolving threat landscape but also internal inertia and
cultural resistance.
The endgame, it seems, is clear: a new operating model that
integrates third-party oversight into strategic planning, embeds risk awareness
across functions, and treats resilience as a continuous, dynamic process rather
than a regulatory checkbox.
How to get there, however, is a different matter.
Against that
backdrop, then, this year’s Vendor Risk Europe event delivered a timely look at
the practicalities, pitfalls, and possibilities of compliance and continuity in
a fast-changing risk environment.
Perhaps unsurprisingly, the regulatory burden introduced by
the Digital Operational Resilience Act (DORA) took center stage, particularly
on day one.
Natalie Druckmann, Head of EMEA at Certa, chaired the opening
panel discussion, examining how institutions have fared since the first wave of
DORA requirements went live across Europe last summer.
And despite broad agreement that the regulation’s intent is
sound, the panelists were forthright about the implementation headaches it has
caused.
What was
largely accepted to be an implementation process that was painfully manual has
spawned a litany of pain points: constantly shifting deadlines and challenges
in aligning with IT functions were seen to hinder progress in other areas.
The DORA data templates were described by one panelist as “cumbersome”,
who lamented the time lost to navigating overlapping frameworks from different
regulators.
Another argued
that institutions often confuse project delivery with actual resilience,
cautioning that short-term compliance can mask long-term fragility. “Delivering
98 data points doesn't make your firm resilient,” he said. “It’s what happens
next – embedding that into day-to-day operations – that matters.”
In fact, integration became a recurring theme, as it emerged
that many firms still operate with siloed first and second lines, with
responsibilities for operational resilience, third-party oversight, and IT
often split across departments.
What quickly became clear in the event sessions was that fragmentation
needs to end if institutions are to respond nimbly to disruption.
