This article explores how third-party risk management has evolved into a strategic business discipline as organizations become increasingly dependent on external providers and interconnected ecosystems. Featuring insights from Julie Gaiaschi of TPRA, the
In an increasingly interconnected global economy, third party risk management (TPRM) has moved from a niche compliance function to a strategic imperative in just a few short years.
In a recent discussion between Andreas Simou, Managing Director of CeFPro, and Julie Gaiaschi, CEO and Co-Founder of the Third Party Risk Association (TPRA), key insights emerged on how the discipline is evolving and what this means for professionals navigating this ever complex landscape.
The Rapid Evolution of Third Party Risk Management
Third party risk management has undergone a significant transformation in recent years. Julie describes how the field has evolved so dramatically that it “seems like it’s an entirely new industry, to be honest.”
Historically, TPRM was largely
confined to heavily regulated sectors such as financial services and healthcare. However, the post-pandemic environment has fundamentally reshaped this
dynamic.
Organizations across industries have recognized the importance of managing third party risks after experiencing severe supply chain disruptions. As Julie explains, post COVID, “retail, manufacturing, you name it” realized supply chain risk mattered when they were no longer getting the products or services they needed.
This expansion reflects a broader realization that third party risk is
not just a compliance issue but a core business risk. Organizations now understand that their ability to
deliver products and services is deeply dependent on the resilience and reliability of their external
partners.
Critical Challenges Facing TPR Professionals
One of the most pressing challenges is the growing complexity of regulatory expectations. Even when organizations are not explicitly regulated, they are increasingly required to demonstrate robust TPRM practices because clients demand it.
Julie notes that many firms feel pressure because “their customers are regulated and asking for TPRM programs,” creating a cascading effect across entire ecosystems. The challenge, she says, lies not
just in complying with regulations, but in understanding how they intersect.
Different jurisdictions impose
varying requirements, and mapping these overlapping frameworks remains a significant operational burden. At the same time, the industry is transitioning from reactive to proactive risk management.
Traditionally, programs relied on periodic assessments, often conducted during onboarding and annually thereafter. But in today’s increasingly demanding world, that approach is no longer sufficient.
