Ask most risk teams how their third-party risk management (TPRM) is going and you'll hear about questionnaires sent, assessments completed and audits scheduled. Ask a different question, "if this supplier went offline tomorrow, what's our plan?", and the room often goes quiet.
That gap is where TPRM is changing.
What our TPRM benchmark found
Our recent TPRM benchmark looked at how organisations across retail, telecoms, construction, transportation and other sectors structure their frameworks. Here are 3 high-level take-aways:
-
Most are moving away from informal, siloed vendor management.
-
At almost all companies, Procurement owns the day-to-day running of TPRM.
-
The vast majority focus their risk assessment efforts strictly on Tier 1 (direct suppliers) because of resource and data constraints.
| We produced our third-party risk management benchmark to support a specific member organisation with a TPRM challenge they raised with us. In this article for non-members, we've shared some highlights. The full benchmark is available to all members. Book a 15-minute exploratory call to find out more about bespoke benchmarking. |
Spend isn't the same as criticality
The traditional shortcut is to focus on the top 10% of suppliers by annual spend. Spend is easy to pull, but it doesn't always match operational criticality. As risk leaders in our network point out, a low-spend supplier providing a specialised piece of software or a niche component can halt operations just as effectively as a high-spend logistics provider.
This is why some organisations are layering their triage: spend, product criticality, cross-departmental surveys to uncover hidden single points of failure, and hard "non-negotiable" gates. Others are looking past Tier 1 to map Tiers 2, 3 and sometimes 4, to spot exposure to things like regional conflict or infrastructure monopolies.
From "did we check them?" to "can we survive without them?"
Members describe a broader shift from compliance-driven, tick-box TPRM towards a strategic approach built around resilience. One of the clearest changes is who owns the plan. Rather than asking whether a supplier has a business continuity plan, forward-thinking teams ask what their own plan is if that critical supplier disappears.
It's a small change in wording, and it changes who is responsible.
Want to go deeper?
We'll be exploring this in our upcoming talk: Third-party risk management: the 5 problems every risk leader is wrestling with on Tuesday 17 November 2026, 3-3:30pm GMT. Come along to hear how peers are approaching it, and bring your own questions.
Share this
Could your business run on the bare minimum? 4 steps to resilience
Your risk framework is mature - but is it actually working?
.png)