Trust Will Become the Ultimate Third Party Risk Control

As third-party risk management becomes increasingly automated, financial institutions must avoid mistaking greater processing power for better decision-making.

Instead, organizations should focus on strengthening human judgment, investing in trusted relationships and developing leaders capable of balancing innovation with operational excellence if they are to remain resilient in an AI-driven future.

Speaking at CeFPro’s latest Vendor Risk Europe conference, the Senior Director Corporate Procurement & Vendor Management at a major European regional bank argued that the greatest challenge facing third-party risk management is no longer simply meeting expanding regulatory requirements.

Rather, it is ensuring people, processes and technology remain aligned as AI transforms how organizations operate.

He explained that regulatory expectations, cloud adoption and increasingly interconnected supplier ecosystems are placing unprecedented pressure on vendor risk teams, while headcount growth is no longer a sustainable solution.

"We cannot solve everything by additional headcount," the senior procurement executive said.

Instead, he argued that organizations must shift their focus away from capacity alone and toward capability.

While traditional measures have concentrated on workload, throughput and process execution, tomorrow's success will depend on "clear risk judgment," business understanding, decision quality and organizational adaptability as technological change accelerates.

He suggested that AI's rapid development is fundamentally changing the environment in which financial institutions operate.

As digital ecosystems increasingly serve autonomous systems as much as human users, risk professionals must spend more time interpreting information than processing it.

That evolution, he argued, elevates human judgment from a supporting capability to a strategic differentiator.

The speaker also emphasized that responsibilities across the three lines must remain clearly defined.

Business functions should continue to own risk and understand service criticality, while second-line teams should establish frameworks, define risk appetite, challenge decisions and monitor effectiveness.

However, he argued that governance frameworks must remain practical if they are to retain business engagement.

"How should business own the risk?" he asked. "How should business understand the criticality if we make it too complex?"

He said reducing unnecessary complexity would help maintain accountability while allowing organizations to achieve compliance more efficiently.

Perhaps his strongest message centered on the cultural implications of AI adoption. Rather than focusing exclusively on technology, leaders must ensure employees understand how their roles will evolve.

"The biggest risk of AI adoption is human disengagement," he said, warning that employees increasingly question whether their expertise remains valuable and what skills they should develop next.

Leadership, he argued, must demonstrate how people and AI can evolve together rather than compete against one another.