display-middle-ads-here
If there is a single truth about the future challenges that Third Party Risk Management will bring in the future, it must surely be that the landscape is going to become more complex and even trickier to navigate than it is now.
One only has to look at the current confusion and lack of preparedness around the EU’s new Digital Operational Resilience Act (DORA) legislation, and the US’s Uyghur Forced Labor Protection regulations to see that the TPRM environment is becoming increasingly multi-faceted – which means the strategies financial institutions use to manage it needs to be equally multi-faceted.
In a recent CeFPro webinar, we asked experts from the TPRM field in both the UK and Europe to share their experiences and insights and give a sense of what risk leaders now need to prioritize in order to deliver effective TPRM strategies that will future proof their supply chains.
In this article, we explore the views of Anne McGowan, Head of Supplier Management, Governance & Risk with Lloyds Banking Group, who has extensive experience in driving best practice in TPRM over a long and distinguished career with the Group.
A key theme to emerge from the discussion was how organizations are grappling with these changes, while also managing the complexity of emerging risks like geopolitical tensions and technological advancements.
At the core of McGowan’s approach to the subject is the recognition that TPRM is not a static field. "You can only be confident about delivering a top-class performance if you're consistently evolving," she says, using the example of Olympic gold medal-winning gymnast Simone Biles to illustrate her point.
"If you were to ask her today how confident would she be to replay her Olympic performance? Would she think it would be as good? Well, it would depend on how much training she had, but probably not."
McGowan’s analogy reinforces the necessity for businesses to continuously adapt their third-party risk management frameworks in response to shifting regulatory landscapes and new risks.
As organizations face mounting pressure to meet regulatory requirements, McGowan acknowledges that confidence in TPRM programs is often questioned, particularly when regulators come knocking.
"It doesn’t matter how mature you are today, you have to be able to move with the demand for new knowledge, new skills," she explained. New directives from regulators, such as DORA, are compelling organizations to rethink their approach.
DORA is a key piece of legislation aimed at ensuring the digital resilience of financial markets, but McGowan admits its prescriptive nature is not without its challenges.
"Deadlines drive urgency rather than the prescriptiveness or not, of the legislation,” she says, going on to explain that, while regulatory guidance may not always be as prescriptive as needed, the approach of many regulators – focused on outcomes rather than rigid rules – has created significant pressure for organizations to respond quickly.
"Once there is regulation, and the nearer a deadline is, the more urgent it becomes," she said.
The stakes are high. Not only do organizations face potential financial penalties for non-compliance, but reputational damage can also be a significant driver of urgency.
"The size of the penalty is important, but it's also your reputational damage as well because that has an impact on your share price," McGowan explains. The cascading effect of non-compliance can ripple through an organization, making it imperative for companies to stay ahead of regulatory requirements, particularly in the face of looming deadlines.
