A critical service is down, the third party has missed its recovery target, and someone finally opens the contract looking for answers. Instead, they find phrases such as “commercially reasonable efforts” and “prompt notification.” This is the moment when third party accountability is tested. If the contract does not define the obligation, the evidence required, or the response to failure, the organization may know that performance was unacceptable without having a clear way to compel action. This blog looks at how practitioners can turn risk terms into usable accountability tools, with practical steps for defining expectations, assigning responsibility, verifying performance, and responding when a third party falls short. Write Risk Terms That Can Be Leveraged Accountability starts with language that works under pressure. A term that cannot be measured, verified, or enforced may help complete a negotiation, but it provides little leverage when the service fails. For each material obligation, the contract should answer: What is the third party required to do? When must it be completed? How will performance be measured? What evidence must the third party provide? What happens if the requirement is not met? The final question is often the weakest. A contract may require a business continuity plan without requiring test results or correction of identified gaps. It may establish an incident-notification deadline without addressing repeated late notices. A missed obligation should lead to an appropriate response. Depending on the severity, that may include increased reporting, a corrective-action plan, executive review, formal notice, contractual remedies, or transition planning. The purpose is not to make every issue punitive. It is to remove uncertainty before a problem occurs. Focus on the Obligations That Matter Most Trying to monitor every contract provision with the same intensity creates plenty of activity but not necessarily better oversight. Accountability should focus on the obligations that protect critical services and support meaningful risk decisions. For higher-risk relationships, these may include: Availability and performance thresholds Incident notification requirements Business continuity and disaster recovery testing Recovery time and recovery point objectives Security and data protection controls Remediation deadlines Material subcontractor changes Transition assistance and data return Termination rights for repeated failures The right priorities will vary by service. A cloud provider, payment processor, call center, and records-storage company should not have identical oversight requirements. Monitoring should reflect how the service could fail and what that failure would mean for the organization. Require Evidence, Not Reassurance Accountability depends on evidence. A third party may state that a control is effective or that an issue has been resolved, but the organization needs enough information to evaluate that claim. The contract should identify the evidence required for material obligations. This may include performance reports, incident notices, recovery test results, remediation records, assurance reports, subcontractor notifications, or documentation of data return and deletion. Receiving evidence is not the same as reviewing it. Someone must determine whether the information is complete and whether it addresses the contractual requirement. Practitioners should also compare third party reports with internal operational information. A dashboard may remain green while internal support tickets increase or transaction backlogs take longer to clear. The third party’s report is an important source, but it should not be the organization’s only view of performance. Accountability Also Runs Inward An organization cannot hold a third party accountable if its own responsibilities are unclear. Strong contractual rights have limited value when no one monitors them or when identified problems have nowhere to go. For each material obligation, the organization should identify: The business owner accountable for the service The third party risk function responsible for oversight and challenge The specialist responsible for evaluating the evidence The review frequency The escalation threshold The governance body authorized to require action Third party risk management has an essential role, but accountability cannot sit with that function alone. Business owners understand service performance. Technology, Cybersecurity, Privacy, Compliance, and Business Continuity teams evaluate specialized evidence. Procurement supports commercial escalation, while Legal advises on notices, remedies, amendments, and termination. Operational resilience or enterprise risk may be positioned to connect third party performance with internal dependencies, customer impact, and the organization’s tolerance for disruption. The structure may differ among organizations. What matters is that responsibility for the complete view is assigned rather than assumed. Act Before a Formal Breach A formal contract breach should not be the first sign that intervention is needed. Repeated near misses, late reports, missed remediation dates, and worsening service trends can justify action before a critical threshold is crossed. Useful escalation triggers may include: Repeated failure or near failure of a critical Service Level Agreement (SLA) Late or incomplete incident notification Failure to meet recovery objectives during testing Overdue high-severity remediation Repeatedly late root-cause reports Material subcontractor changes without required notice Rising backlogs, outages, or customer complaints Each trigger should lead to a defined response. Otherwise, escalation depends on who notices the issue and how persistent that person is. That is not a reliable control. Practitioner Action Items The following actions can move accountability from contract language into daily oversight: Start with critical services. Select a manageable group of third parties that support essential operations. This directs limited resources toward relationships where weak accountability could cause the greatest harm. Identify the obligations that matter most. Focus on commitments that affect continuity, regulatory duties, customer impact, security, or recovery. This prevents important requirements from being buried among routine commercial terms. Test whether each obligation is usable. Confirm that it includes a timeframe, measurement method, evidence requirement, and response to failure. If the organization cannot determine whether the obligation was met, it will struggle to enforce it. Assign an owner and reviewer. The person managing the relationship may not be qualified to evaluate security evidence or recovery testing. Match the reviewer to the obligation and document who has final accountability. Compare external and internal evidence. Reconcile third party reports with incident records, complaints, ticket volumes, backlogs, and performance data. Differences may reveal deterioration before an SLA is missed. Define escalation in advance. Establish when the organization will require enhanced monitoring, remediation, formal notice, or transition planning. Predefined triggers reduce delay and inconsistent treatment. Track corrective action through closure. An accepted remediation plan is not a resolved issue. Confirm that promised actions are completed and supported by evidence. Use failures to improve future contracts. Feed incidents, failed tests, and recurring exceptions back into contract templates and negotiation guidance. Otherwise, the same weakness may return at renewal. Practitioner Takeaways Third party accountability is not about creating a combative relationship. It is about making expectations usable and ensuring that both parties understand what follows when those expectations are not met. The practical test is straightforward: Can the organization identify the obligation, evaluate the evidence, assign responsibility, and act when performance falls short? If not, the contract may contain strong language without creating meaningful accountability. Author Bio Hilary Jewhurst Sr. Membership & Education Coordinator at TPRA Hilary Jewhurst is a seasoned expert in third party risk and risk operations, with nearly two decades of experience across financial services, fintech, and the nonprofit sector. She has built and scaled third party risk programs from the ground up, designed enterprise-wide training initiatives, and developed widely respected content that helps organizations navigate regulatory complexity with clarity and confidence. Known for turning insight into action, Hilary’s thought leadership and educational work have become go-to resources for professionals looking to mature their TPRM programs. She regularly publishes articles, frameworks, and practical guides that break down complicated risk topics into meaningful, accessible strategies. Hilary recently joined the Third Party Risk Association (TPRA) as a staff member, supporting industry-wide education, peer learning, and advancing best practices. She is also the founder of TPRM Success, a boutique consultancy that helps organizations strengthen their third party risk management capabilities through targeted training, tools, and strategic guidance.

The Third Party Risk Association (TPRA), in partnership with ten leading third party risk management service providers, is pleased to provide TPRM professionals with the Standard Trust Portal Guidance for Third Party Risk Management (TPRM). Definition A Trust Portal is a centralized hub that provides transparent, self-service access to security, compliance, privacy, and governance information. It enables collaborative due diligence activities by helping customers and other stakeholders quickly validate the effectiveness and maturity of your third-party risk program. Designed to unify how organizations demonstrate security, compliance, privacy, and governance maturity, the Trust Portal Guidance provides a standardized framework for building and managing trust portals, which are centralized hubs for evidence sharing and transparency between organizations and their third parties. The guidance aims to empower practitioners, vendors, regulators, and platform providers to align around a single, trusted model that reflects industry expectations and best practices for transparency, efficiency, and responsible evidence sharing. It also supports AI-driven TPRM technologies by standardizing evidence formats for automated review and analysis. Trust Portal Pillars TRANSPARENCY Open, accessible trust data for responsible risk decisions. EFFICIENCY Automated, reusable evidence. TRUST Verified information driving stronger partnerships. INNOVATION Enabling AI-ready, proactive due diligence. What It Can Do For You For Practitioners: Reduces questionnaire fatigue, improves review quality, and saves time through standardized, AI-friendly evidence formats. For Vendors/Third Parties: Demonstrates maturity and transparency; less time answering one-off questionnaires. For Regulators: Encourages uniformity and accountability in demonstrating control effectiveness. For Service Providers (Platforms): Provides a shared framework to enable AI and automation in TPRM workflows. Download Now This document is available for FREE download. How It Was Created Our TPRM Service Provider Advisory Council spent months working quietly behind the scenes, researching and collaborating to create a cohesive and comprehensive resource to be freely shared with all members of the TPRM community. Acknowledgements & Contributors Thank you to the following organizations, which contributed perspectives and subject matter expertise to help shape this guidance (displayed in alphabetical order): Their collective insights reflect practical experience across third-party risk management, compliance automation, trust assurance, and practitioner due diligence.

Every few years a profession gets a moment where the ground shifts and the people who read it early pull away from the people who wait. Third party risk management is in one of those moments right now. The pressure is easy to feel and hard to name, so let me name it plainly: the part of your job that is easiest to automate is the part most programs still spend most of their time on. This is not a threat to fear. It is a map. It tells you exactly where to stop investing your career, and exactly where to start. The rest of this blog will discuss that map. Not the technology for its own sake, but what it means for how you should be building yourself and your program over the next two years. The skill that is quietly losing its value For most of our careers, questionnaire throughput was a real skill. Knowing the frameworks very well, moving assessments through the pipeline, keeping the register current, chasing third parties for responses. People built reputations on being fast and thorough at this, and they deserved to. That skill is depreciating, and the reason is simple. A third party can now generate a flawless questionnaire response in twenty minutes with an AI model. You can review it in twenty seconds with another one. When both sides automate the exchange of claims, the exchange stops carrying information. The output is fast, polished, confident, and empty. If your professional value is anchored to moving that exchange efficiently, your value is anchored to the one thing the technology just commoditized. This is uncomfortable to say out loud, and I say it because the practitioners who hear it early have time to move, and the ones who hear it late do not. The good news is that the skills replacing questionnaire throughput are more interesting, more durable, and far harder to automate. Where the value is moving Think of the modern TPRM skill set in three horizons. What you should acquire now, what you should build in parallel, and what you should aim to own over the next two to three years. This is as true for how you develop yourself as it is for how you develop your program. Acquire now: evidence literacy and AI judgment. The single highest-leverage move available to you is learning to read for evidence instead of attestation. That means reading a SOC 2 for the findings that hide outside the exceptions table, the complementary user entity controls that are quietly your obligations, and the subservice carve-outs that are a fourth-party map printed inside the report. It means telling the difference between a control that is enforced and one that is merely available, a distinction that lives in configuration exports, not questionnaires. And it means knowing where AI genuinely helps in your workflow and where it fails, so you can use it without being fooled by it. None of this requires a technical background. All of it requires unlearning the habit of treating a filled-in form as an answer. Build in parallel: governance and monitoring design. As volume rises and headcount stays flat, the analyst's job shifts from doing assessments to governing how they get done. That means designing which controls receive human review and which can be AI-accepted with spot-checks, documenting overrides in a way that survives an examiner, and building monitoring that fires on real signals instead of the calendar. Your assessment cycle takes weeks; public breach disclosure now averages well over a hundred days. Annual reassessment was never going to close that gap. The practitioners who can design event-driven monitoring, and defend it, become indispensable. Own long-term: program architecture and business translation. The most durable skills are the ones furthest from automation: designing an AI-augmented program from the ground up, and translating technical findings into the language a Chief Financial Officer (CFO) or a board risk committee will act on. These are the capabilities that turn a senior practitioner into a program leader, and they compound every year you hold them. Building the program, not just the résumé Everything above is also a blueprint for the program you are responsible for, because your career and your program advance through the same moves. Start by asking the question most programs never ask out loud: why does our program actually exist? Is it funded by regulatory mandate, by customer and market pressure, or by genuine conviction that the program prevents real losses? The honest answer shapes everything. A program that can only demonstrate documentation is now competing against infinitely cheap documentation and losing. A program that can demonstrate prevented loss has no such competition. If you cannot point to a single incident your program caught that would have cost the business real money, then the value of your program is reduced. This is the most important thing on your roadmap, not another questionnaire integration. Then, you will want to point your technology investments at evidence rather than attestations. The wave of automation has currently meant "faster questionnaires", which points current investments to the least informative part of the process. The programs that will matter most are shifting the object of automation from what a third party says to what can be observed: from documents to query-able data, from attestation to configuration, from annual cycles to continuous signals. And when you evaluate any AI-assisted tool, hold it to a standard of auditability. When an examiner asks you to reconstruct one decision, can the tool show the inputs, the model version, the citations, and the human who signed off? Most cannot. That question is the best filter you have for separating serious platforms from confident demos. Why this is bigger than our function The reason this deserves real attention, from you and from your leadership, is that delegated trust has become the largest attack surface most enterprises have. Companies outsource more of what they do every year. Every third party relationship, every integration, every AI agent granted standing access is a delegation of trust and an extension of the attack surface. The incidents that defined recent years were not perimeter failures; they were trust failures, a compromised build pipeline, a stolen integration token, a socially engineered supplier help desk. Enterprise resilience now rests on third party risk in a way it simply did not a decade ago. That is the opportunity hiding inside the disruption. A function that was often treated as a compliance cost center is becoming central to whether an organization can withstand the failure of the many parties it depends on. The practitioners who build the evidence-first skills, and the programs built on them, are the ones who will be in the room when it matters. Where to start this quarter Preparation does not require permission or budget. Pick your three most critical third parties and write down, honestly, what you actually know about their security posture versus what they attested. That gap is your starting point. Read the scope section of your next SOC 2 yourself, not the AI summary. Run one assessment you did manually through an AI tool and study where it agreed, missed, and surprised you. Build the habit of collecting one piece of observable evidence per critical third party per quarter. Small, unglamorous, and compounding. This conviction is why we built the "TPRM in the Age of AI" series with TPRA. Module 1, AI and the Future of Third-Party Risk, lays out what is changing and why, from first principles, and closes with concrete actions you can take this week and this quarter. Module 2, The Practitioner's Skill Stack, is the hands-on training for the evidence-first skills above: reading the artifacts, running AI with discipline, and designing monitoring that works. Both are CPE-eligible through the TPRA training platform. They exist to help you make exactly the moves this article describes. The questionnaire era is ending, and that is good news for anyone willing to build. The work ahead is not to fill out the form faster. It is to become the practitioner, and to build the program, that can tell whether the form was ever true. Start now, while it is still early. Being early is the whole advantage. Author Bio Clarence Chio Cofounder and CEO of Coverbase Clarence Chio is cofounder and CEO of Coverbase and has taught AI and security at UC Berkeley since 2019. He is the instructor for the "TPRM in the Age of AI" professional development series, available through TPRA. Coverbase is one platform for third-party risk and security, with AI that tailors to your program and controls and continuously evaluates every surface of exposure.

Explore jobs in third party risk management from organizations hiring TPRM professionals. New listings added regularly. Start your search today. TPRM Job Listings Searching for a TPRM-specific job? Check out the listings below from organizations looking for talented TPRM professionals! Note: TPRA reserves the right to remove any job listing for any reason and without communication to the contact. Post a Job Securian Financial Director, Third Party Risk Management & Transformation (Hybrid) View Job St. Paul, MN (Hybrid) KPMG Associate Director, Head of Third-Party & Supplier Risk Services View Job Fort Worth, TX (hybrid) Centene Corporation Manager, Third Party Risk Management View Job Missouri, United States (Remote) The Landline Company Manager, IT Compliance & Vendor Management View Job Fairless Hills, PA (Remote) StoneX Group Inc. Senior Manager, Third Party Risk Management View Job Chicago, IL Amazon Supplier Risk Manager, GPO Global Supplier Management View Job TX, TN, VA, WA Morgan Stanley Director, Third Party Risk Management View Job Dallas, TX Morgan Stanley Vice President, Third Party Risk Management View Job Dallas, TX Morgan Stanley Associate, Third Party Risk Management View Job Dallas, TX Parexel Vendor & Third-Party Management Quality and Compliance Manager View Job Uxbridge, England (Remote) JP Morgan Chase Supplier Controls Intelligence Analyst - Vice President View Job Plano, TX/Columbus, OH Morgan Stanley Third Party Risk & Site Management, Director View Job Dallas, TX LOAD MORE

Learn about and register for events outside of the TPRA that are applicable to TPRM. Vendor-Hosted Events The TPRA promotes the industry of third party risk, which includes events conducted by other third party risk-related groups and organizations. Check back here regularly to see our list of vendor-hosted events. If you would like to promote your next third party risk-specific event, please complete the form below . Disclaimer: TPRA does not endorse or sponsor the products/services of one particular organization; however, we do communicate training opportunities for the benefit of the community. Filter by Organization Select Organization Filter by Event Type Select Event Type Filter Download Tenchi Security In-Person Conference Tenchi Conference 2026 Wednesday, November 4, 2026 Tangara Palace Hotel, São Paulo, Brazil The fourth edition of the Tenchi Conference is set to be even bigger and more impactful, featuring renowned speakers and new panels led by seasoned executives in Third-Party Cyber Risk Management (TPCRM). Under the theme “TPCRM: The New Era of Inside-Out,” this year’s edition will explore a new perspective on third-party risk - shifting from reactive approaches to a more integrated, continuous, and inside-out strategy. Building on last year’s success, this global leading event dedicated to Third-Party Cyber Risk will once again bring together CISOs, Board Members, Cybersecurity Professionals, GRC Experts, and DPOs from leading organizations across global industries. Expect a full day of in-depth discussions and a dynamic agenda exploring TPCRM best practices, risk mitigation strategies, and enhanced security across multiple industries. The agenda is currently being carefully curated and will be revealed soon. Watch the highlights from last year’s edition: https://www.tenchisecurity.com/en/company/events Invitation is personal and non-transferable – subject to confirmation. And to end the day on a high note, you’re invited to a special Happy Hour featuring a surprise performance - the perfect opportunity to expand your network and connect with industry leaders. Have insights or real-world experience in TPCRM? Apply to speak at the Tenchi Conference 2026 and share your perspective with a highly qualified audience – plus the opportunity to win a trip to RSA Conference 2027*. We are looking for 30-minute sessions featuring relevant cases or innovative approaches. *See more information and submit your proposal here: https://forms.gle/nen5uQpb1ZQpMMbR6 . Register OneTrust Live Webinar AI for Risk Vs. Risk for AI: Navigating the New Governance Imperative Thursday, November 12, 2026 11:00 AM EST This session explores how forward-thinking teams are using AI to enhance compliance, automate decision-making, and improve visibility—while building the frameworks needed to manage model risk, data privacy, and regulatory exposure. Join OneTrust and Deloitte to learn how leading enterprises are striking the right balance between innovation and control in an increasingly AI-driven landscape. Register Global Resilience Federation (GRF) Virtual Bootcamp Disconnect / Reconnect Virtual Tabletop Exercise Tuesday, November 17, 2026 1:00 PM ET About this exercise The GRF Business Resilience Council's ORF Tabletop Exercise series challenges teams to test resilience, refine incident response, and share best practices through panel-led discussions with real-time inputs and data aggregation. Participants deepen their understanding of service dependencies and their ability to adapt and maintain operations across threat types. Register Cloud Security Alliance (CSA) Virtual Conference AI Security Summit 2026: Zero Trust Wednesday, November 18, 2026 Wed, Nov 18, 2026 11:00 AM - Thu, Nov 19, 3:30 PM EST AI agents are now making decisions, touching sensitive systems, and acting on your organization's behalf, often faster than any human can review. Attackers are moving at that same machine speed, and non-human identities already outnumber your workforce many times over. CSA has been tracking this shift as the AI Vulnerability Storm, a wave of AI-discovered exploits arriving faster than most security teams can patch. The old perimeter was never built to govern any of this, and the next incident is not a matter of if, but when. Implementing Zero Trust principles is essential to deploying AI safely at scale. It replaces implicit trust with continuous verification, which is exactly what autonomous agents and machine identities require. CSA has spent years helping define what that looks like in practice. Our Zero Trust Advancement Center (ZTAC), Certificate of Competence in Zero Trust (CCZT), and research like our AI Vulnerability Storm briefings all contribute to that foundation. That same research and expert network informs the agenda for CSA's FREE two-day virtual AI Security Summit 2026: Zero Trust , where practitioners can learn alongside the people doing this work. If you're responsible for securing AI initiatives, modernizing identity, or leading Zero Trust strategy in an increasingly autonomous enterprise, this is the event you can't afford to skip. Register free today. Register SecurityScorecard Live Webinar Cybersecurity After AI: What CISOs Must Unlearn to Stay Ahead Wednesday, November 18, 2026 12:00pm EST Artificial intelligence is changing more than cyberattacks. It is reshaping how organizations build trust, manage risk, and operate security programs. Join Dr. Aleksandr Yampolskiy, CEO and Co-Founder of SecurityScorecard, and Dr. Yonesy Núñez, six-time CISO and security executive at Surf AI, for a discussion on how cybersecurity leadership is evolving in an era of machine-speed threats, expanding third-party ecosystems, and agentic technologies. Drawing on decades of experience leading security programs at organizations including DTCC, Wells Fargo, Citi, and Jack Henry, Núñez shares lessons on building resilient security organizations, engaging boards and regulators, and preparing for a future where trust, context, and automation increasingly define competitive advantage. Topics include AI's impact on cybercrime, the future of third-party risk management, agentic security, board-level cyber leadership, and what separates resilient organizations from reactive ones. Register Center for Financial Professionals (CeFPro) In-Person Conference AI Governance Europe Tuesday, December 1, 2026 December 1-2, 2026 | London The answer is here. AI Governance Europe 2026 brings together the executives responsible for overseeing AI across financial services—from risk and compliance to legal, technology and data. Discover how leading organisations are building governance frameworks that balance innovation, accountability and regulatory compliance. Register RSM US Live Webinar From access to action: Governing AI agents in the enterprise Wednesday, December 2, 2026 2 p.m. ET | 1 p.m. CT Artificial intelligence agents are changing how organizations interact with enterprise applications, data repositories and business processes. As adoption accelerates, leaders must determine how agent identities should be governed, what permissions agents require and how those activities can be monitored effectively. Unlike traditional access models focused exclusively on human users, AI environments often involve a combination of user identities, agent identities, workloads and system accounts. Organizations need practical ways to limit access, monitor activity and reduce the risk of unintended actions. Join RSM professionals as they discuss how AI agents are transforming enterprise access models and why Model Context Protocol (MCP) is becoming an important mechanism for connecting agents to enterprise systems and data. Through practical implementation examples, governance principles and a live demonstration, attendees will learn how organizations are addressing authorization, access controls and enterprise-data governance in AI-enabled environments. Register Submit an External Event TPRA Practitioner Members can submit upcoming events they'd like displayed on this page using the form below. Some events may also be shared via our monthly events emails and/or quarterly newsletter. TPRA does not post on-demand/recorded events to this page. TPRA Vendor Members can submit their upcoming events through the Vendor Member Submissions form . Submitter Information First name* Last name* Email* Event Information Event Title* Event Host* Event Type* Event Description* Event Date* Event Time (please include time zone)* Link to learn more and/or register for the event* Anything else we should know? Submit

Join TPRA’s free 2025 Virtual Conference on September 10 to explore continuous improvement in Third Party Risk Management. Attend expert-led sessions, earn CPE credits, and enhance your TPRM strategy. 2026 Virtual Conference Emerging Risks & Operational Resiliency Wednesday, September 9, 2026 • 9:00 AM - 4:00 PM Central Open to All • Free • 6 CPE Credits Available View Presentations View Recordings (Members Only) Join the Third Party Risk Association (TPRA) for our 2026 Virtual Conference: " Emerging Risks & Operational Resiliency " on Wednesday, September 9 , 2026, from 9:00 AM to 4:00 PM CT . What to Expect As organizations navigate an increasingly complex risk landscape, this conference will explore the latest emerging threats—from evolving regulatory expectations to third party vulnerabilities and operational disruptions. Attendees will gain actionable guidance on strengthening resilience, enhancing risk frameworks, and proactively addressing uncertainties that can impact business continuity. Through expert-led sessions, participants will leave better equipped to anticipate challenges, adapt to change, and build more robust, future-ready organizations. Who Should Attend? This conference is ideal for: TPRM professionals seeking to enhance their programs Risk management and compliance officers Procurement and vendor management specialists IT and cybersecurity professionals involved in third party risk Whether you’re focused on third-party risk, enterprise risk, or operational continuity, this event offers valuable perspectives and tools to help you stay ahead in a rapidly shifting environment. Register Now TRACK 1 Driving Resilience Through Continuous Improvement TRACK 2 Driving TPRM Transformation Through Innovation TRACK 3 Navigating Emerging Risks & Regulatory Change Agenda Fliter by: Track 8:55 AM - 9:00 AM 5 minutes View Full Session Presentation Welcome & Kick-Off Julie Gaiaschi, CEO & Co-founder, TPRA Zoom Lobby General Session Kick off this virtual conference with a few words from Julie Gaiaschi , CEO & Co-founder… Read More 9:00 AM - 9:50 AM 50 minutes View Full Session Presentation From Headlines to Action - Managing Geopolitical Risk Across Third-Party Ecosystems Sandeep Suresh, Supply Wisdom Room 1 Track 1: Driving Resilience Through Continuous Improvement Geopolitical events no longer impact only global enterprises—they can disrupt organizations of every size through… Read More 9:00 AM - 9:50 AM 50 minutes View Full Session Presentation A New Can of Worms: Why Compliance Alone Can't Contain a Zero-Cost Adversary Richard Hummel, SecurityScorecard Room 2 Track 2: Driving TPRM Transformation Through Innovation Compliance frameworks are built on an assumption that no longer holds: that adversaries need time,… Read More 9:00 AM - 9:50 AM 50 minutes View Full Session Presentation Beyond the Checklist: Building a Unified Third-Party Control Framework Jan Stappers, LL.M., PgD EVP, GRC Solutions Strategy, Mitratech Room 3 Track 3: Navigating Emerging Risks & Regulatory Change The TPRM landscape has become a maze of overlapping mandates, standards, and stakeholder expectations, and… Read More 10:00 AM - 10:50 AM 50 minutes View Full Session Presentation Continuous Monitoring That Improves Oversight Ken Wolckenhauer, Nordea Bank Room 1 Track 1: Driving Resilience Through Continuous Improvement Turning on risk monitoring and alert feeds is easy but turning them into better decisions… Read More 10:00 AM - 10:50 AM 50 minutes View Full Session Presentation Moving at Attacker's Speed: How to Rethink TPRM for the Post-Mythos Era Jake Olcott, Bitsight Room 2 Track 2: Driving TPRM Transformation Through Innovation Third-party risk management was built for a slower world. Today, organizations face a growing volume… Read More 10:00 AM - 10:50 AM 50 minutes View Full Session Presentation Gaining c-suite acceptance of emerging risks: regulation is your friend Rachel Elliott, DRI Room 3 Track 3: Navigating Emerging Risks & Regulatory Change Navigating emerging supply chain risks is becoming evermore complex, particularly with events become concurrent. The… Read More 11:00 AM - 11:50 AM 50 minutes View Full Session Presentation The Risk You Reviewed Isn’t the Risk You Have Natalie Druckmann, Certa Room 1 Track 1: Driving Resilience Through Continuous Improvement The third-party risk function is caught between two converging threats and most programs are equipped… Read More 11:00 AM - 11:50 AM 50 minutes View Full Session Presentation Staying One Step Ahead: Why Intelligence Is Replacing Traditional Third-Party Risk Management Austin Starowicz, RiskRecon Room 2 Track 2: Driving TPRM Transformation Through Innovation Cybersecurity isn't becoming more difficult because organizations have more vendors—it's becoming more difficult because adversaries… Read More 11:00 AM - 11:50 AM 50 minutes View Full Session Presentation The Risks Beyond the Hype: Operational Resilience, Hidden Financial Exposure, and the Next Frontier of TPRM Courtney Turner, Deere & Co Room 3 Track 3: Navigating Emerging Risks & Regulatory Change As organizations race to manage AI-related risks, other emerging threats are quietly gaining momentum. This… Read More 12:00 PM - 1:00 PM 60 minutes View Full Session Presentation Lunch Meal Take a break to enjoy some lunch before jumping back into learning with our next… Read More 1:00 PM - 1:50 PM 50 minutes View Full Session Presentation Your Vendor Didn’t Change, But Its AI Did: Rethinking Material Change in TPRM Brian Shaw, Independent Room 1 Track 1: Driving Resilience Through Continuous Improvement A third party may remain under the same contract while quietly changing its models, data… Read More 1:00 PM - 1:50 PM 50 minutes View Full Session Presentation When Risk Evolves, Agility Wins: AI Transforms Third-Party Risk Management Bryn Sedlacek, Aravo Room 2 Track 2: Driving TPRM Transformation Through Innovation Today's TPRM programs must support resilient operations, secure IT, ethical business practices, regulatory compliance, and… Read More 1:00 PM - 1:50 PM 50 minutes View Full Session Presentation Third-Party Risks and Sanctions Michael Volkov, Volkov Law Group Room 3 Track 3: Navigating Emerging Risks & Regulatory Change With the beginning of the aggressive trade enforcement era, companies need to focus on third-party… Read More 2:00 PM - 2:50 PM 50 minutes View Full Session Presentation Fourth-Party Risk: The Exposure You Can’t Always See Tracey Forney, previously Sr Information Security Manager with Federal Reserve Room 1 Track 1: Driving Resilience Through Continuous Improvement Dependencies on sub-contractors and upstream providers can introduce risk that is not obvious from primary… Read More 2:00 PM - 2:50 PM 50 minutes View Full Session Presentation We Don’t Know What We Don’t Know: The Inherent Risk of Mature TPRM Paul Valente, VISO TRUST Room 2 Track 2: Driving TPRM Transformation Through Innovation A vendor assessment can be thorough and defensible while still missing the risk that matters.… Read More 3:00 PM - 3:50 PM 50 minutes View Full Session Presentation The AI-Enabled Vendor: Building a Third-Party AI Risk Assessment Aligned to NIST AI RMF Nitin Agarwal, Luminace Room 1 Track 1: Driving Resilience Through Continuous Improvement Third-party vendors are rapidly embedding generative and agentic AI into the services organizations already consume,… Read More 3:00 PM - 3:50 PM 50 minutes View Full Session Presentation Beyond the AI Hype: What’s Actually Working in Third-Party Risk Management Sophia Corsetti, ProcessUnity Room 2 Track 2: Driving TPRM Transformation Through Innovation AI has produced no shortage of demos, claims, and new terminology. But after the initial… Read More 2:00 PM - 2:50 PM 50 minutes View Full Session Presentation From Finding to Fixing: Managing Third-Party Issues, Exceptions & Performance Kholofelo Mothibi, Corebride Financial Room 3 Track 3: Navigating Emerging Risks & Regulatory Change Identifying a vendor risk is only the beginning. The real test of a TPRM program… Read More 3:50 PM - 4:00 PM 10 minutes View Full Session Presentation Conference Conclusion Julie Gaiaschi, CEO & Co-founder, TPRA Zoom Lobby General Session We will close out this event with a few announcements and drawings for raffle prizes! Speakers Apply to Speak Courtney Turner Enterprise Third Party Risk Manager Deere & Co Paul Valente Co-founder & Chief Customer Officer VISO TRUST Richard Hummel VP, Threat Intelligence SecurityScorecard Brian Shaw Third-Party Risk & Compliance Executive Independent Ken Wolckenhauer Head of Vendor Management Nordea Bank Maxine Ayers Director Operational Risk Management Corebridge Financial Kholofelo Mothibi Head of TPRM Corebridge Financial Natalie Druckmann VP, Head of EMEA Certa.ai Sandeep Suresh Managing Director Supply Wisdom Sophia Corsetti Sr Product Marketing Manager ProcessUnity Nitin Agarwal Director Enterprise AI & Risk Luminace Tracey Forney previously Sr Information Security Manager Federal Reserve Bryn Sedlacek VP, Product Management Aravo Solutions, Inc Michael Volkov CEO The Volkov Law Group PC Austin Starowicz Director, Solutions Consulting Mastercard Cybersecurity Rachael Elliott Director of Global Strategy and Innovation DRI International Jake Olcott VP Government Affairs Bitsight Jan Stappers LL.M., PgD EVP, GRC Solutions Strategy Mitratech Prevalent Julie Gaiaschi CEO & Co-founder Third Party Risk Association (TPRA) Thank you to our Sponsors ! Interested Sponsors Be sure to visit their virtual booths during the event!