Third Party Risk Strategy Evolves as Resilience Pressures Intensify

In the ever-evolving and increasingly complex ecosystem of financial services, third party risk management has moved from a background compliance activity to a defining pillar of operational resilience.

According to the managing director of a leading risk management consultancy, this shift reflects the pressures created by geopolitical volatility, tightening regulation, and the sector’s growing dependence on complex networks of external providers.

Speaking to delegates at a recent CeFPro event, she explained that what once revolved around cost efficiency and vendor performance now centers on continuity, resilience, and strategic accountability.

She noted that a recent industry discussion brought clarity to a theme she believes now defines modern third party oversight: simplification.

With sprawling webs of suppliers supporting critical and important functions, firms must understand which services are fundamental and how they are delivered, maintained, or unwound.

Simplification, the risk management expert argued, is not about reducing scope but about sharpening focus on what truly matters for business continuity.

This philosophy intersects powerfully with ongoing regulatory reform. She highlighted the pivotal years surrounding the rollout of the UK’s operational resilience framework, which forced firms to rethink how they prepare for, manage, and recover from disruption.

Yet just as those practices began to mature, the Digital Operational Resilience Act ushered in a more intrusive and harmonized approach across the EU.

DORA, led by the European Central Bank, places digital dependencies and critical third party providers under far closer scrutiny, signaling a structural shift toward data-driven, cross-sector resilience expectations.

But in her view, regulation is only one part of the story. Geopolitics, once peripheral to vendor oversight, now occupies center stage.

Conflicts in Ukraine and the Middle East and widening political instability require firms to question where their critical suppliers operate, under what legal and social conditions, and how resilient those jurisdictions may be during crisis.