Third-Party & Supply Chain

Every risk discipline carries a habit that outlives its usefulness. In third-party risk management, that habit is the self-attested questionnaire. It is the artifact the whole practice is organized around. A relationship begins, a security questionnaire goes out, the vendor returns a few hundred answers, an analyst reviews them, and the file is closed until next year's cycle. The ritual is so established that it is easy to forget it was built for a smaller, slower, more stable world than the one we operate in now

Britain’s financial regulators will begin overseeing four of the world’s largest technology providers on Monday, extending their reach into the cloud infrastructure that banks and other financial institutions increasingly rely on to keep operating.

For months the world's attention has drifted toward the Strait of Hormuz with the uneasy awareness reserved for places that are both geographically small and economically immense. The waterway has always been more than a shipping route. It is a pressure point. When conflict interrupts traffic there, the consequences do not remain in the Gulf for long. They surface weeks later in warehouses, procurement meetings and production schedules half a world away, where businesses discover that the shortest distance between a geopolitical crisis and an empty shelf is often a container ship that never arrived.

A supplier that looked perfectly sensible in January can become a liability by April without having changed at all. The factory is the same, the quality standards are the same, and the people answering the phone are the same people they were a few months earlier. What changed happened somewhere else, perhaps in a government office thousands of miles away, perhaps in the latest round of trade negotiations, perhaps in a policy announcement that never mentioned the supplier by name. Yet procurement is suddenly looking elsewhere, finance is recalculating costs, and operations is asking how quickly production can move if it has to.

It takes about a second. An analyst pastes a contract into a chat box and requests a summary. A recruiter drops a stack of résumés into a tool to rank them. A finance manager uploads a draft board deck and asks for a tighter narrative. The cursor blinks, the answer appears, and everyone moves on. Nothing felt risky. Nothing broke. Yet in that one second, something important happened that almost no one in the building noticed. Information left the organization and went somewhere it had never been.

The response to my session at Icon 2026 reminded me of something I have seen many times in this field. Organizations are not struggling to agree with the argument for supplier risk management. They are struggling to act on it. In the latest piece on my website, We Are Measuring the Value of TPRM Wrong, I argued that the business case for supplier risk management has been framed too narrowly and too focused on workflow, controls, and compliance, and not nearly enough on avoided disruption, avoided loss, and the confidence to move through uncertainty.

Japan’s Financial Services Agency has published a research report examining how financial institutions can strengthen the management of third-party cybersecurity risks, commissioning Deloitte Tohmatsu Cyber to conduct the study.