The rapid rise of AI and IoT is transforming third-party risk management, bringing both unprecedented opportunities and increasingly complex threats. Financial institutions must prioritize continuous monitoring, proactive communication, and innovative too
display-middle-ads-here
There has never been a time of greater technological transformation than now. The relentless evolution of the Internet of Things and AI opens up a new world of exciting opportunities and change.
But it also opens up a web of exponentially greater threats and risk which, like a multi-headed hydra, multiply at a near incomprehensible speed and create an ever more complex management ecosystem in which to meet those risks head on.
This expanding network of risk demands, in return, a continuous evolution of monitoring systems that are resilient and robust enough to at least keep pace with, if not get ahead of, the emerging nature of risk.
At a recent CeFPro event focusing on vendor risk, the managing director of one of the world’s largest retail banks observed that continuous monitoring tools were increasingly at the vanguard of third party risk management.
“We’ve been using supply chain monitoring tools for the last year and a half,” he explained. “They send alerts, which require review and analysis with subject matter experts from cybersecurity, compliance, and financial teams.
“These alerts can signal potential financial issues or even future bankruptcies. While they don’t always trigger an exit plan, they allow us to track specific services and third parties closely.”
However, he went on to say that no system is infallible, noting that any monitoring system is inherently vulnerable to false positives. This, he said, presents an additional challenge: “You need to recheck them, talk to your third party, improve your review processes,” he said. “It’s all about partnering with the third party to ensure a thorough risk assessment.”
Get ahead of the curve
Effective third-party risk management starts well before issues arise. According to the executive, embedding service level agreements (SLAs) into contracts from the outset is essential.
“From the beginning, when there’s a new service, it’s important to define SLAs with the service manager and business team before signing the contract,” he said. “After that, service managers absolutely must review them regularly – monthly, quarterly, or semi-annually – to ensure compliance.”
Which opens up another, more internalized issue: how do you ensure you’re creating, adopting, or applying systems and tools that people will use? The best tool in the world, he says, is a liability if it’s too complicated to use.
.jpeg)