Third-party risk management must evolve beyond regulatory compliance and become a strategic business capability, with industry leaders arguing that better data, stronger supplier relationships and closer alignment with business strategy are essential to b
Financial institutions should stop
treating third-party risk management as a compliance obligation and instead
position it as a core business capability that strengthens resilience, enables
growth and protects customer trust, according to senior operational risk
leaders.
While regulatory initiatives have
accelerated investment in supplier oversight over recent years, participants
argued that many organizations remain trapped in a compliance mindset that
limits the strategic value TPRM can deliver.
Speaking at CeFPro's opening 2026
Vendor Risk Europe conference, the Group Head of Resiliency and Recovery and
Resolution Planning within Operational Risk at a major global bank challenged
delegates to rethink the purpose of third-party risk management altogether.
Although regulatory frameworks have
undoubtedly strengthened operational resilience, she argued that organizations
now need to move beyond satisfying supervisory expectations and instead focus
on how supply chains contribute directly to commercial success and long-term
resilience.
"I'm just bored of only being a
compliance requirement," the executive said. "It's third-party risk
management. Risk management is in the title."
While acknowledging the enormous
effort firms invested in meeting new regulatory requirements over recent years,
she suggested progress has stalled because many organizations continue framing
supplier oversight primarily as a regulatory obligation rather than a business
discipline.
Instead, she proposed viewing supply
chains as an integral component of every major enterprise risk.
Sanctions, fraud, cybersecurity,
operational resilience and financial crime all increasingly depend upon
external providers, meaning supplier oversight should be embedded throughout
existing risk management activities instead of operating as a standalone
function.
She also questioned whether
third-party risk management should even be described as a strategic advantage.
"I view them as table
stakes," she said. Organizations either understand and manage supplier
dependencies or "you're in the papers for a very bad reason."
Rather than creating competitive
differentiation on its own, effective supplier oversight enables firms to
pursue strategic objectives with greater confidence while protecting customers
and maintaining trust.
The discussion repeatedly returned to
the importance of understanding business strategy before assessing supplier
risks.
Instead of beginning with
questionnaires or compliance reviews, she said, organizations should first
identify strategic priorities, determine which suppliers support those
objectives and then evaluate where concentrations, dependencies or operational
weaknesses could hinder delivery.
The executive argued that stronger
relationships with key suppliers are equally important.
If organizations truly understand
where they depend on critical vendors and maintain close partnerships with
them, suppliers themselves may identify emerging problems before clients even
recognize them.
Data quality emerged as another
central theme. According to the executive, organizations cannot deliver
meaningful business insight unless supplier information is complete, accurate
and aligned with enterprise architecture.
