News, analysis, and guidance across GRC, risk, audit, and regulatory compliance.
Third-Party Risk ManagementRapidly emerging vulnerabilities demand proactive third-party risk management. Avoid common TPRM mistakes that turn a week of exploits into a crisis.
Third-Party Risk ManagementNine exploited vulnerabilities surfaced in five days, emphasizing the critical need to select a CVE monitoring model that fits your vendor portfolio and compliance needs.
Third-Party Risk ManagementThe Extreme Networks case highlights how delayed self-disclosure can cost companies millions and lead to prolonged DOJ monitorships.
Third-Party Risk ManagementThird-party financial crime risk is evolving rapidly. The UK s Failure to Prevent Fraud offense is now in effect. Cryptocurrency exchanges are under tighter sanctions scrutiny. Geopolitical upheavals
Get weekly security insights and compliance updates delivered to your inbox.
Third-Party Risk ManagementThe European Banking Authority (EBA) released guidelines in 2024 that reveal a critical gap in how financial institutions manage third-party relationships. These guidelines cover the full lifecycle of
Third-Party Risk ManagementThe Question at Hand Risk managers at banks face a timing dilemma this fall. The OCC , Federal Reserve, FDIC, and NCUA proposed new third-party risk management guidance on September 11, 2026, with com
Third-Party Risk ManagementThe European Supervisory Authorities Autumn 2026 risk update has exposed vulnerabilities that many GRC leaders thought they d already addressed. The findings reveal a gap between what financial instit
Third-Party Risk ManagementScope This guide shows you how to build a third-party risk management program that satisfies SS2/21, PS26/2, DORA, and the EBA Guidelines on ICT and security risk management. It s tailored for financi
Third-Party Risk ManagementThe question at hand The PRA and FCA have introduced new third-party risk management rules, effective by March 2027, sparking a debate: how much of your TPRM program should rely on automation versus h
Third-Party Risk ManagementThird-party risk teams are testing AI tools right now. Some are seeing real time savings. Others find their AI-powered platform can t answer basic questions about vendor documentation. The issue isn t
Third-Party Risk ManagementMost third-party risk programs can tell you everything about a supplier: its SOC 2 status, financial health, geographic footprint, and cybersecurity posture. But ask what happens when that supplier go
Third-Party Risk ManagementYour vendor questionnaire hasn t changed since 2019, but vendors are now deploying advanced AI models that could alter the speed and economics of cyber risk faster than your defenses can adapt. Financ
Third-Party Risk ManagementFinCEN s August 2020 guidance on politically exposed persons (PEPs) confirms what compliance officers already know: there s no checklist. You re expected to design a risk-based due diligence framework
Third-Party Risk ManagementIf your company imports tin, tantalum, tungsten, or gold into the EU, you ve probably heard assumptions about what the EU Conflict Minerals Regulation requires. Some of these assumptions are incorrect
Third-Party Risk ManagementSanctions compliance has become a boardroom priority, yet many third-party risk programs still operate on outdated assumptions. These assumptions were formed before the Russian Federation s invasion o
Third-Party Risk ManagementIf you re aiming to comply with the EU Corporate Sustainability Due Diligence Directive (CSDD), you might think rigorous supplier audits are the solution. Conduct site visits, review policies, and che
Third-Party Risk ManagementWhen your Third-Party Risk Management (TPRM) program treats every vendor the same, you re either over-investing in low-risk relationships or under-managing critical ones. You need a structured way to
Third-Party Risk ManagementThe EU s Corporate Sustainability Due Diligence Directive (CSDDD) hasn t seen its first enforcement case yet, with compliance deadlines set for 2027. However, you can anticipate potential failure mode
Third-Party Risk ManagementThe Securities and Exchange Commission (SEC) is sending letters to technology companies, probing their relationships with distributors, resellers, and other third parties in high-risk corruption areas
Third-Party Risk ManagementWhen Deputy Attorney General Lisa Monaco referred to sanctions enforcement as the new FCPA in summer 2022, it marked a significant shift in the DOJ s focus on economic crime. Yet, many third-party ris
