Third-party risk management must move beyond compliance checklists toward stronger ownership, connected governance, predictive metrics and genuine supplier relationships. Elena Pykhova argues that organizations have built increasingly sophisticated frameworks but still struggle with fundamental questions around accountability and translating third-party information into decisions.
Financial institutions need to stop
treating third-party risk management as a compliance exercise and build
governance around ownership, connected risk disciplines and relationships
capable of surviving disruption.
Policies and frameworks may have
matured considerably, but fundamental questions over who actually owns supplier
risk remain unresolved.
Speaking at CeFPro’s 2026 Vendor Risk
Europe event, Elena Pykhova, Founder of The Operational Risk Company and author
of Operational Risk Management in Financial Services, argued that
organizations have advanced from traditional outsourcing oversight toward
managing thousands of critical suppliers, yet effective ownership remains
surprisingly difficult.
Business owners should own and manage
third-party relationships because suppliers effectively extend their processes.
That means conducting due diligence,
raising incidents, reviewing performance and reporting metrics.
Dedicated TPRM functions meanwhile
provide coordination, maintain registers and oversee policies and controls,
with second-line risk providing challenge and oversight.
But documented responsibility does
not necessarily translate into genuine accountability.
“Who owns third-party failure?”
Pykhova asked, highlighting the tendency to look toward TPRM, business
continuity, operational risk or boards when suppliers fail. Missing from that
instinct can be the business owners themselves.
Organizations therefore face choices
between persevering with business ownership, centralizing responsibility within
specialist TPRM functions or adopting hybrid models where complex or widely
shared suppliers receive centralized ownership.
Pykhova said many organizations
believe they operate the first model on paper while behaving more like the
second or third in practice.
Whichever structure organizations
choose, she argued that supplier management must also move beyond contracts and
controls.
“Suppliers are not contracts, they
are people,” Pykhova said. She contrasted compliance-heavy relationships built
around controls, metrics and penalties with organizations developing
collaborative relationships with critical suppliers.
Examples included supplier open days
and joint planning designed to help vendors understand critical services and
their role in delivering them.
That relationship mentality should
extend internally. Pykhova argued that TPRM, operational risk and resilience
must become connected through common data, methodologies and processes.
