Topic starter
11/07/2026 8:27 pm
TL;DR: Effective third-party risk management starts with scoping, inventorying suppliers, and securing executive sponsorship so teams can focus limited resources on the relationships that create the highest exposure, according to OneTrust. The governance lesson is that TPRM fails when it is treated as a procurement checklist rather than an ongoing risk programme.
Editorial analysis by NHI Mgmt Group, based on content published by OneTrust: “How to Start a Third-party Risk Management Program: Get Leadership Buy-in”.
Key questions
Q: How should organisations decide which third parties belong in scope first?
A: Start with relationships that can access sensitive data, connect to internal systems, or affect critical business functions.
Q: Why does third-party risk management need executive buy-in?
A: Executive buy-in gives TPRM the authority to influence procurement, legal, finance, and security decisions.
Q: What breaks when software and access inventories are not kept current?
A: When inventories are stale, organisations cannot tell whether an asset is still needed, still entitled, or already retired.
Practitioner guidance
- Define scope by exposure and criticality Classify third parties by data access, system integrations, contractual dependency, and business criticality before assigning review depth.
- Build a living third-party inventory Track new, terminated, and revised relationships in one governed register so reassessment triggers are visible to security, privacy, procurement, and legal teams.
- Set minimum viable review tiers Reserve the deepest due diligence for suppliers that host data, process regulated information, or connect into core operational systems.
Bottom line: Third-party risk programmes work best when scope is explicit and tied to exposure, data access, and business criticality.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 8:56 pm
Scope discipline is the real control, not programme size: third-party risk fails when organisations confuse coverage with control. A smaller programme that consistently prioritises high-exposure relationships will outperform a broad programme that tries to assess everything at once. Practitioner conclusion: define scope by business impact and access risk, then hold the line.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- 52% of respondents see AI security decision-making power shifting toward platform and infrastructure teams rather than the executive suite, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: When should teams prioritise deep due diligence over lighter reviews?
A: Prioritise deep due diligence when a third party hosts data, processes regulated information, supports critical operations, or integrates tightly with internal systems. Light-touch reviews are more appropriate for low-impact commodity suppliers. The goal is to reserve scarce review capacity for the relationships that can materially change the organisation's risk posture.
👉 Read our full editorial: Third-party risk program scope and leadership buy-in need clearer boundaries