Third-Party Risk Must Stop Owning Everyone Else’s Problems

Third-party risk management must stop trying to own every supplier-related problem and instead give the business the tools, data and confidence to own risk itself.

As supplier ecosystems expand and operational resilience expectations intensify, centralized TPRM teams risk becoming bottlenecks unless accountability moves closer to the people making decisions and managing supplier relationships.

Speaking at CeFPro’s latest Vendor Risk Europe event, the Senior Third Party Risk Manager at a leading UK building society said years spent developing policies and frameworks had exposed a fundamental challenge: translating theory into everyday decision-making.

“We spent years defining the TPRM policy, or TPRM theory, but the challenge now is operationalizing that in work in reality and at scale,” she said.

That challenge became particularly acute during a major organizational integration, when the building society absorbed around 800 additional supplier relationships, pushing its overall portfolio into the thousands.

The experience exposed the limitations of a model in which problems routinely gravitated toward the TPRM function, regardless of where accountability for the underlying risk actually belonged.

The risk manager said that when something went wrong, TPRM was frequently expected to provide the answer.

That created an operating model that could not scale. The organization therefore began moving TPRM away from pure oversight and policy toward an enablement function, shifting ownership and accountability into the business while helping decision-makers exercise stronger control.

Integration also acted as a stress test, exposing inconsistencies that had been less apparent under normal operating conditions.

Suppliers appeared multiple times with different risk ratings, teams relied on different data sources and definitions of materiality and criticality varied. Duplication created further inefficiency as different functions sometimes pursued conflicting actions.

The experience forced the organization to reconsider its processes from the ground up.

Deep collaboration between TPRM and procurement supported the introduction of a redesigned source-to-contracting solution, while 1,400 hours of training and workshops helped embed the changes.

Controls were hard-coded into the process so contracts could not be signed and suppliers could not be paid without following the required workflow.