Jenna Wells argues that traditional approaches to third-party risk management are no longer fit for purpose in a world shaped by geopolitical instability, cyber threats, AI adoption, and increasingly complex supplier ecosystems. She explains how annual as
Third party risk management is no longer about
annual questionnaires, isolated compliance checks or static assessments sitting
forgotten in spreadsheets.
According to Jenna Wells, CEO at leading risk
intelligence consultancy Supply Wisdom, the speed and complexity of global
disruption now means banks must rethink how they identify, monitor and respond
to operational threats across sprawling supplier ecosystems.
Wells argues that the traditional model of periodic
vendor assessment has effectively collapsed under the weight of geopolitical
instability, cyber threats, sanctions risk and rapidly evolving artificial
intelligence exposure.
“The second it’s sent, it’s stale,” Wells says,
referring to static supplier assessments. “You get that baseline as of the day
it was filled out, and then you are absolutely blind.”
Drawing on her experience both as a practitioner and
now as a solutions provider, Wells lays out a global risk landscape that has
transformed dramatically over the past decade.
Disruption is disparate. Its causes are manifold.
Most obviously in recent years, perhaps, are the conflicts in Russia, Ukraine,
and the Middle East, tensions in China and Taiwan, the global pandemic of 2020
and 2021, but front of mind though they undoubtedly are, they are far from the
only factors in an increasingly vulnerable global third-party ecosystem.
Outsourcing has also accelerated aggressively across
financial services. Banks now depend on vast networks of suppliers,
subcontractors and technology providers spread across multiple jurisdictions
and geopolitical environments.
Wells believes many institutions still underestimate
how little visibility they truly possess over their global networks. “One of
the first areas where companies are fooling themselves is they don’t know the
full scope of their outsourced vendor population,” she says.
According to Wells, the problem extends beyond
direct suppliers. The real challenge increasingly lies within secondary,
tertiary and even deeper supplier relationships that support critical
operations behind the scenes.
“You can outsource the function, you can never
outsource the risk,” she says.
That distinction has become increasingly important
as regulators tighten expectations around operational resilience and
third-party oversight.
Wells points specifically to the EU’s Digital
Operational Resilience Act as evidence that continuous monitoring is no longer
optional for financial institutions, saying, “It’s actually now a regulatory
requirement.”
She warns that many organizations continue to manage
risks in fragmented silos, with separate teams overseeing cyber, compliance,
ESG, operational and financial risk using disconnected tools and inconsistent
methodologies.
