As cascading third- and fourth-party disruptions outpace siloed procurement checklists, organisations must elevate third-party risk management into a core pillar of enterprise risk management to protect their supply chains and build lasting operational resilience.
Key Insights
- Third- and fourth-party failures no longer happen in isolation; a single vendor disruption now triggers cascading operational, financial, compliance, and reputational risks across the enterprise.
- Delegating third-party risk management to procurement or individual business units could result in starving programmes of strategic funding, cross-functional integration, and end-to-end supply chain visibility.
- Closing the resilience gap requires extending enterprise risk management principles across the corporate ecosystem through a “just-in-case” supply chain mindset, pragmatic “good enough” tech integration, and a targeted, risk-based approach to vendor oversight.
Historically, organisations procured third-party services primarily for cost efficiency. Today, the scope of third-party products and services has evolved significantly, ranging from outsourcing critical processes and focusing on strategic priorities to reaching niche markets. While this shift drives growth, it also exposes businesses to risks well beyond their immediate control.
As such, third-party risk management (TPRM) continues to grow in importance amid a complex threat landscape, greater reliance on external vendors, digital transformation, tighter regulations, and environmental and geopolitical disruptions. Regulatory scrutiny has also intensified to ensure organisations fully understand the risks and impacts their third parties pose.
Consequently, leading organisations now require evidence that their third parties have best-practice controls in place and that those controls operate effectively. Stakeholders, customers, board members, and regulators all expect organisations to maintain mature TPRM programmes to monitor and mitigate risks across outsourced data and processes.
Against this backdrop, the Institute of Enterprise Risk Practitioners (IERP®) hosted a Tea Talk to address this challenge. Led by Ramesh Pillai, Chairman of the Board of Governors of the IERP®, the session broke down how to stop treating third-party risk management or nth-party risk management as an isolated procurement problem and elevate it to a core enterprise asset.
The Cascading Threat Landscape: When Third and Fourth Parties Fail
External disruptions are no longer rare edge cases; they are an operational reality. Nearly three in four companies have experienced at least one major third-party disruption within the last three years, while four in ten have weathered three or more. Even when operations stay online, two-thirds of businesses lose value through inefficient billing processes and contracts that fail to specify Service Level Agreements (SLAs) and financial incentives.
This exposure deepens further down the supply chain. Because primary vendors rely on their own networks of subcontractors, fourth-party failures, from manufacturing shipping delays to security vulnerabilities at a supplier’s cloud provider, regularly trigger downstream crises. Over three-quarters of organisations urgently need better visibility into these nth parties, yet most lack direct relationships or contractual arrangements to manage them.
Crucially, modern third-party risk management (TPRM) must continue to grow and mature. While cyber and data breaches remain top concerns, risks are widely distributed across operational, compliance, reputational, financial, and ESG domains, and they rarely occur in isolation. As Ramesh noted, “An organisation experiencing a breach that results in compromised customer data poses operational, reputational, financial, and compliance risks. You need to manage this on an enterprise-wide basis carefully.”
Because corporate data flows continuously across cloud servers and remote work environments, mitigating these converging threats requires monitoring supplier health, enforcing strict data protection compliance, and securing backup vendors, forcing leadership to reconcile lowest cost with long-term operational resilience.
Why Current TPRM Operating Models Are Breaking
Over three-quarters (77%) of organisations admit that overhauling their third-party risk management (TPRM) operating model is now overdue, with many accepting that luck, rather than their TPRM programmes, helped them avoid a major third-party incident during the COVID-19 pandemic.
The core bottleneck is structural: businesses frequently delegate TPRM to procurement or individual business units, treating it as a transactional checklist rather than a strategic priority. Consequently, only one in three managers report that their TPRM programme is well integrated with partner functions like procurement and legal, or that they report regularly to senior management to set clear lifecycle roles.
This siloed approach directly starves programmes of enterprise-level funding. One in two organisations warn that they lack sufficient in-house capabilities to manage the third-party risks they face, while six in ten practitioners believe TPRM is undervalued. As Ramesh emphasised, “It is an enterprise risk issue. It is not an individual supplier management issue.” Because leadership underestimates this complexity, limited budgets are spent on business-as-usual costs and tactical fixes rather than strategic improvements across technology, talent, and operational resilience.
Compounding this resource stretch is an expectation-reality gap. Although practitioners expect technology to automate nearly two-thirds of TPRM tasks within three years, existing tools remain fragmented across procurement, contract management, and risk registers. Over half of practitioners are frustrated by a serious lack of end-to-end supply chain visibility, while expanding mandates, including plans by three in ten managers to assess all third parties for environmental risk, push already stretched teams to their limits.
Anchoring TPRM in Enterprise Risk Management
Closing the TPRM gap requires organisations to stop applying tactical patches to strategic vulnerabilities. Modern businesses are now deep interconnected ecosystems where a single disruption, such as a natural disaster hitting a sole overseas component supplier, can halt operations. Building true operational resilience demands extending best-practice enterprise risk management principles across the entire supply chain.
For risk practitioners, this starts with two fundamental mindset shifts. First, organisations must transition from a just-in-time operating model to a just-in-case approach by diversifying suppliers and securing partners closer to home. Second, when integrating fragmented procurement, contract lifecycle, and vendor risk systems, teams must move from chasing perfection to implementing “just good enough” solutions.
As Ramesh cautioned, “Don’t go for perfection. Go for good enough. In today’s environment, things are changing too quickly. If you wait for perfection, you die. You need to go for good enough, and then you move on from there.”
Similarly, stretched teams cannot assess every vendor for every emerging risk without crippling onboarding throughput times. Instead, ERM programmes must adopt a targeted, risk-based methodology. Rather than conducting full environmental risk assessments on all suppliers, practitioners can link ESG to reputational risk by running targeted background checks to ensure third and nth parties do not have a chequered ESG past or negative affiliations.
By reserving rigorous pre-onboarding due diligence, continuous lifecycle monitoring, and business continuity evaluations for high-risk arrangements, ERM leaders can protect the enterprise against downsides while driving speed and value creation.
Lessons on TPRM For Risk Practitioners
Third-party risk management will remain high priority as organisations navigate evolving regulations, complex operating models, and supply chain disruptions. Because budgets remain tight and there are no quick fixes for these systemic challenges, businesses must stop treating vendor oversight as an isolated compliance task. Whether an organisation is building a foundational programme from scratch or optimising a mature framework, true transformation requires elevating TPRM into a coordinated, enterprise-wide priority.
As Ramesh concluded, “One easy, key method of dealing with, implementing, and achieving your TPRM transformation is by extending best-practice ERM principles throughout the corporate ecosystem. It is as simple as taking your ERM principles and putting them through the whole corporate ecosystem, including your TPRM programme.”
