For many years, third-party risk management professionals, consultants and even
regulators have said the same thing. To do TPRM right, you have to implement a risk-based
methodology.
Basically, you differentiate how deep you go with the risk assessment depending on the
vendor. High risk vendors get a full assessment, medium risk vendors get less, and low risk
vendors get the least.
On top of the depth, of course it also affects the frequency. How soon and how often you
reassess a vendor depends on which risk level they are in. High risk maybe every year,
lower risk every two years or even longer.
Where This Thinking Came From
This old principle came from one simple fact. Resources in third-party risk management
are very limited.
A large enterprise can have more than 1000 suppliers, and one assessment done manually
can take 2 to 4 weeks. No team can do that for every vendor, every year. So people need to
prioritize, and the risk-based approach is how they did it.
What Changed In 2026
But today, in 2026, almost all third-party services are using AI in some sort. Which also
means that change is happening at the third party very fast.
If you are still using the old methodology, where you only come back for a reassessment
once a year or every 2 years, things have already changed a lot by the time you look again.
The risk might already be beyond your company’s risk tolerance, and you wouldn’t know.
There is also another issue. Today, a vendor might be a low risk vendor, based on how the
company uses the service and the data it processes. But then the scope changes and it
becomes a high risk vendor, without the security or risk officer knowing about it.
The reassessment of that vendor, with a more appropriate assessment scope, will only
happen in the next cycle. That can be another 1 to 2 years. Or it doesn’t happen at all,
because people still assume it’s a low risk vendor.
AI Is Also The Solution
Of course, the solution for this is also AI. AI can do an assessment very, very fast. What
used to take days or weeks can now be done in under an hour.
And because it’s that fast, the assessment can also be done much more frequently than
when people do it manually.
Why We Can Remove The Old Principles
At 3rdComply we believe that with AI, and the way we build ourAI service for third-party
risk management, we can remove these old principles.
Why? Because we don’t need so many different layers of depth and breadth of
assessment for high, medium and low risk vendors anymore. Every vendor can get the
same full assessment.
And we can do the reassessment and monitoring much more often than once a year.
Every day even, if you want.
Of course, knowing which vendors are most critical still matters, for example when you
decide who to escalate first or where you need an exit plan. But it no longer decides which
vendors get assessed and how deep.
So basically, AI ruins these principles once and for all.
What This Means For Your TPRM Program
If your TPRM program is still built around risk tiers and yearly reassessments, maybe it’s a
good moment to ask if that is still a risk decision, or just a capacity decision from the old
days.
That’s exactly what we built 3rdComply for. Curious how your team looks at this. Happy to
exchange thoughts.