News, analysis, and guidance across GRC, risk, audit, and regulatory compliance.
Third-Party Risk ManagementScope This guide shows you how to build a third-party risk management program that satisfies SS2/21, PS26/2, DORA, and the EBA Guidelines on ICT and security risk management. It s tailored for financi
Third-Party Risk ManagementThe question at hand The PRA and FCA have introduced new third-party risk management rules, effective by March 2027, sparking a debate: how much of your TPRM program should rely on automation versus h
Third-Party Risk ManagementThird-party risk teams are testing AI tools right now. Some are seeing real time savings. Others find their AI-powered platform can t answer basic questions about vendor documentation. The issue isn t
Third-Party Risk ManagementMost third-party risk programs can tell you everything about a supplier: its SOC 2 status, financial health, geographic footprint, and cybersecurity posture. But ask what happens when that supplier go
Get weekly security insights and compliance updates delivered to your inbox.
Third-Party Risk ManagementYour vendor questionnaire hasn t changed since 2019, but vendors are now deploying advanced AI models that could alter the speed and economics of cyber risk faster than your defenses can adapt. Financ
Third-Party Risk ManagementFinCEN s August 2020 guidance on politically exposed persons (PEPs) confirms what compliance officers already know: there s no checklist. You re expected to design a risk-based due diligence framework
Third-Party Risk ManagementIf your company imports tin, tantalum, tungsten, or gold into the EU, you ve probably heard assumptions about what the EU Conflict Minerals Regulation requires. Some of these assumptions are incorrect
Third-Party Risk ManagementSanctions compliance has become a boardroom priority, yet many third-party risk programs still operate on outdated assumptions. These assumptions were formed before the Russian Federation s invasion o
Third-Party Risk ManagementIf you re aiming to comply with the EU Corporate Sustainability Due Diligence Directive (CSDD), you might think rigorous supplier audits are the solution. Conduct site visits, review policies, and che
Third-Party Risk ManagementWhen your Third-Party Risk Management (TPRM) program treats every vendor the same, you re either over-investing in low-risk relationships or under-managing critical ones. You need a structured way to
Third-Party Risk ManagementThe EU s Corporate Sustainability Due Diligence Directive (CSDDD) hasn t seen its first enforcement case yet, with compliance deadlines set for 2027. However, you can anticipate potential failure mode
Third-Party Risk ManagementThe Securities and Exchange Commission (SEC) is sending letters to technology companies, probing their relationships with distributors, resellers, and other third parties in high-risk corruption areas
Third-Party Risk ManagementWhen Deputy Attorney General Lisa Monaco referred to sanctions enforcement as the new FCPA in summer 2022, it marked a significant shift in the DOJ s focus on economic crime. Yet, many third-party ris
Third-Party Risk ManagementThe Corporate Sustainability Due Diligence Directive (CSDDD) was formally approved by the European Council on May 24. It s a unique regulation that goes beyond typical supply chain concerns like cyber
Third-Party Risk ManagementThe Challenge In early May, a consumer lending company discovered that a third-party cloud platform storing customer data had been breached. The stolen records included names, Social Security numbers,
Third-Party Risk ManagementYour vendor risk team is constantly pitched AI features that promise to transform your third-party assessments or eliminate manual reviews entirely. While these claims sound impressive in demos, they
Third-Party Risk ManagementThe Wirecard fraud wasn t a sudden explosion. It was a slow-motion collapse of every control layer that should have stopped it. By the time investigators confirmed that €1.29 billion in escrow account
Third-Party Risk ManagementYour board just asked if your company is ready for the EU s Corporate Sustainability Due Diligence Directive (CSDDD). If you re a CISO or GRC leader, this is now your responsibility. Scope of This Gui
Third-Party Risk ManagementThe Court of Justice of the European Union (CJEU) has issued rulings that fundamentally change how your team must evaluate trust structures in the context of EU sanctions and anti-money laundering (AM
Third-Party Risk ManagementThe European Supervisory Authorities (EBA, EIOPA, and ESMA) have issued a joint statement highlighting the cyber risks associated with frontier AI models. They urge financial entities to enhance gover
