The question at hand
The PRA and FCA have introduced new third-party risk management rules, effective by March 2027, sparking a debate: how much of your TPRM program should rely on automation versus human judgment?
One side argues that automation is essential for scaling vendor oversight across expanding ecosystems. The other insists that meaningful risk assessment requires context and expertise that technology can't replicate. Both perspectives have merit, and with regulatory expectations becoming more prescriptive, the stakes are high.
This isn't just theoretical. You've got roughly two years to align your TPRM processes with updated standards, and the choices you make now will determine if your program meets regulatory expectations.
The case for automation-first TPRM
Automation advocates present a strong efficiency argument. Managing 800 vendor relationships and 200 new questionnaire responses per quarter makes manual review impractical. Automated scoring, workflow routing, and evidence validation enable small teams to maintain oversight at scale.
Technology can standardize processes that have been inconsistent. When each assessor interprets "high risk" or "acceptable evidence" differently, your risk register becomes unreliable. Automated scoring engines apply the same criteria consistently, ensuring auditability and the ability to track risk metrics over time without reconciling different analysts' judgments.
Speed is another factor. Automated questionnaire routing, auto-population of responses, and AI-assisted evidence review can reduce assessment cycles from weeks to days. When your business needs to onboard a new payments processor quickly, that speed is crucial.
From a regulatory standpoint, automation supports Ongoing Vendor Monitoring, a requirement of modern TPRM frameworks. Manual quarterly reviews don't meet this standard.
The case for judgment-centered TPRM
Skeptics argue that while automation optimizes for volume, TPRM requires understanding context that doesn't fit in dropdown menus.
Consider a SaaS vendor that scores "medium risk" on an automated assessment but processes your most sensitive customer data and has direct API access to core systems. Automation sees one set of answers, but your security architect sees risks that questionnaires don't capture. Which perspective matters more when explaining your risk posture to regulators?
Automated scoring also struggles with materiality. A vendor handling $50,000 annually but supporting a critical application deserves different treatment than a $500,000 vendor providing office supplies. Technology can't always distinguish between contractual importance and operational criticality without human insight.
Over-automation poses compliance risks. If your TPRM program relies solely on auto-scored questionnaires and misses a material risk that human review would catch, you've created a control deficiency that regulators will flag. The PRA and FCA's updated rules emphasize understanding third-party dependencies and concentrations, which requires thinking beyond standardized assessments.
The judgment-centered argument is that risk assessment is an analytical exercise, not just data processing. You can automate workflows and evidence collection, but you can't automate understanding whether a vendor's incident response capability matches your recovery time objectives.
Where practitioners actually land
Most mature TPRM programs blend both approaches. They automate repeatable tasks and reserve human judgment for critical decisions.
Automation handles intake workflows, questionnaire distribution, evidence collection, and initial risk scoring. These are high-volume, rules-based activities where consistency is key. A vendor submits their SOC 2 report, your platform validates the auditor's signature and report date, checks the opinion type, and flags exceptions. No human needs to verify that a Type II report is actually Type II.
Human review is essential at decision points: validating inherent risk classifications for new vendors, evaluating whether a vendor's control environment addresses your specific risk concerns, determining whether a gap requires remediation or can be accepted with compensating controls, and deciding whether a vendor's incident response meets your recovery requirements.
This split makes operational sense. If you're assessing 50 vendors per month, you can't manually review every response. But you can require human sign-off on high-risk vendors, material service providers, and any vendor with access to regulated data.
Our take
The right approach depends on your goals, but here's what we'd prioritize to meet the March 2027 deadline:
Automate evidence collection and validation thoroughly. You don't need analysts manually checking if SOC 2 reports are current or if insurance certificates meet coverage requirements. Technology handles this faster and more reliably than spreadsheets.
Keep risk classification and materiality assessment human-driven. Automated scoring can inform these decisions, but someone who understands your business needs to confirm that your payment processor is critical and your break-room coffee vendor isn't. This is where regulatory scrutiny will focus during TPRM program reviews.
Use automation to highlight what needs human attention, not to replace it entirely. A well-designed platform flags vendors with changing risk profiles, highlights control gaps that exceed your tolerance, and routes high-risk assessments to senior reviewers. It doesn't auto-approve vendors based on correct answers alone.
The regulatory environment demands demonstrable, ongoing oversight. You'll need technology to prove continuous vendor risk monitoring. But you'll need documented human judgment to prove you're managing that risk, not just measuring it.
Build your program so that when a regulator asks, "How did you determine this vendor was low risk?" you can point to both your automated scoring methodology and the analyst who validated that classification based on the vendor's actual role in your operations. That combination of systematic process and informed judgment is what mature TPRM looks like.
