Organisations are embracing technology solutions to mitigate growing third-party risks, research from Gartner says.

The increase in trade volatility, persistent cyber-attacks, new regulatory requirements, and supply chain disruptions, are rapidly advancing the adoption of third-party risk management (TPRM) technology solutions, the business and technology analysis firm said.

“Regulators and stakeholders are certainly paying attention; they are interested in how organizations are effectively managing their third-party risk activities,” said Antonia Donaldson, director analyst in Gartner’s Assurance Practice.

“Many organisations, particularly multinationals, are experiencing an exponential increase in the number of third parties they rely on in order to conduct their business around the world.”

The intersection creates a perfect storm and heightens third-party risk. Organisations seek to surface, escalate, and mitigate third-party risk by leveraging the latest TPRM technology solutions.

“Deploying TPRM technology is not a magic solution, but in an increasingly complex business landscape TPRM platforms allow organisations to better mitigate the inherent risks while continuously monitoring their third and fourth parties,” said Donaldson.

“With a large number of vendors in the TPRM technology market and the lack of a one-size-fits-all solution, the market is in the early stages of maturity with future consolidation quite possible,” said Donaldson.

“Many large enterprises use two or more technology solutions with distinct TPRM capabilities, which multiple business functions then leverage.”

Organisations are finding that a siloed approach to third-party management across disparate functions doesn’t tend to work well. Many multinationals are formalising third-party oversight and governance, then leverage TPRM technology solutions to surface risks more rapidly.

To address this need, many TPRM technology providers continue to invest in integrated cross-functional risk-management capabilities, allowing clients and customers to manage their third-party risk domains across multiple business functions and numerous stakeholders.

“Many vendors are incorporating machine learning and AI to support automated assessment and analysis; this allows companies to better evaluate and respond to third-party risks,” said Donaldson.

“With appropriate disclosures and human review, embedded AI will be a competitive differentiator – managing and making sense out of large volumes of TPRM data is resource intensive.”

Recommended reading

• Comment | The Growing Threat of Third-Party Cyber Risks
• Is Third-Party Risk Now the Weakest Link in Cybersecurity?
• JPMorgan CISO Calls for ‘Urgent’ Overhaul of Third-party Vendor Security
• Is Bad Communication Behind the Rise of Third-party Risks?

Recommendations for Buyers

A robust TPRM platform should enable seamless flow of risk information across all relevant functions and users, thereby enhancing the organisation’s visibility into potential these risks. When selecting a TPRM solutions, adaptability and scalability are key.

Organisations should ensure that the chosen platform can meet both immediate and future programme needs. It is crucial to establish a ‘must-have’ list of capabilities before engaging with vendors to streamline the selection process.

“When evaluating licensing options, companies should look beyond cost considerations,” said Donaldson.

“It is important to assess both short-term and long-term implementation and integration requirements, including APIs, to ensure the chosen TPRM solution aligns with the organisation’s risk priorities and strategic objectives.

“By taking these essential steps, organisations can effectively manage third-party risks.”