Third-party risk is no longer something organizations can review once a year and file away for audit season. Vendor incidents now move in hours, regulators expect stronger oversight, and a single provider can disrupt hundreds of businesses at once.

In this episode of the Third Party Risk Institute Podcast, we discuss why traditional annual questionnaires are falling short and why continuous third-party risk monitoring is becoming a core expectation for risk, procurement, compliance, cybersecurity, and vendor management teams.

We cover what continuous monitoring really means, why security ratings should be treated as early-warning signals rather than final answers, and how organizations can monitor vendor risk across cybersecurity, operational resilience, financial health, concentration risk, fourth-party risk, and AI-related vendor exposure.

You’ll also hear practical insights on DORA, NIST CSF 2.0, U.S. banking guidance, security ratings, KRIs, vendor risk dashboards, concentration risk, and the operating model needed to turn alerts into action.

If your organization still relies heavily on point-in-time assessments, spreadsheets, or annual vendor reviews, this episode will help you rethink what effective third-party risk management should look like in 2026.

🎧 Enjoying the podcast?
Explore more resources, expert insights, and certification programs at www.thirdpartyriskinstitute.com

📱 Follow us on LinkedIn for real-world conversations and industry trends: Third Party Risk Institute Ltd.

📬 Have a question or topic you'd like us to cover?
Email us at: info@thirdpartyriskinstitute.com

Third-party risk management is changing fast. For years, many organizations have relied on questionnaires, point-in-time assessments, manual workflows, and fragmented ownership across procurement, cyber, compliance, resilience, privacy, model risk, and business teams. But with AI, cyber ratings, data ecosystems, shared assessments, trust centers, regulatory pressure, and operational resilience expectations becoming more important, the future of TPRM is moving beyond traditional vendor due diligence.

In this episode of the Third Party Risk Institute Podcast, Linda Tuck Chapman speaks with Matthew Moog, Principal of Risk Managed Services at EY, about where third-party risk management is heading and what risk professionals need to understand now. Matt shares lessons from his career across EY, TrueSight, and OneTrust, including the challenges of standardizing assessments, building shared third-party risk utilities, using data before sending questionnaires, and rethinking how organizations assess, monitor, and respond to supplier risk.

This conversation explores some of the biggest issues facing risk, procurement, cybersecurity, compliance, and operational resilience teams today, including:

• Why traditional third-party risk assessments are no longer enough
• How AI and automation may change vendor risk management workflows
• Why the future of TPRM depends on better data, not more questionnaires
• The role of cyber ratings, trust centers, attestations, certifications, and standardized data
• How organizations can reduce fragmented third-party risk processes
• Why operational resilience, fourth-party risk, and dependency mapping are becoming critical
• How DORA, regulatory expectations, and global financial services guidance are shaping TPRM
• Why human judgment still matters in an AI-enabled risk environment
• What risk professionals should focus on to build a stronger career in TPRM

Matt also shares practical career advice for professionals entering or growing in third-party risk management, operational risk, cyber risk, vendor risk, and governance roles.

This episode is essential listening for anyone working in third-party risk management, vendor risk management, supplier risk, operational resilience, cybersecurity risk, regulatory compliance, procurement, financial services risk, AI governance, fourth-party risk, or enterprise risk management.

🎧 Enjoying the podcast?
Explore more resources, expert insights, and certification programs at www.thirdpartyriskinstitute.com

📱 Follow us on LinkedIn for real-world conversations and industry trends: Third Party Risk Institute Ltd.

📬 Have a question or topic you'd like us to cover?
Email us at: info@thirdpartyriskinstitute.com

The first four months of 2026 have already reshaped how organizations think about third-party risk.

From regulatory pressure like Digital Operational Resilience Act to the rapid adoption of AI across vendor ecosystems, the gap between what organizations assess and what they actually understand is becoming more visible and more risky.

In this episode, we break down what’s actually changed in third-party risk so far this year, not at a theoretical level, but based on real developments, regulatory shifts, and operational challenges organizations are facing right now.

This is not a high-level conversation. This is a practical review of where programs are falling short and what needs to change.

What We Cover in This Episode

• Why traditional third-party risk models are failing in 2026
• The growing disconnect between vendor assessments and real-world dependencies
• How AI adoption is introducing new, unmeasured risks in third-party ecosystems
• What regulators are actually expecting (and where organizations are still behind)
• The rise of concentration risk, fourth-party risk, and infrastructure dependencies
• Why business continuity assumptions are no longer holding up
• What strong third-party risk programs are starting to do differently
• Practical steps to rethink your approach, immediately

Who This Podcast Is For

• Third-Party Risk Managers
• Vendor & Supplier Risk Professionals
• Procurement Leaders
• Operational Risk & Resilience Teams
• Compliance and Audit Professionals
• Anyone responsible for understanding how third parties impact business continuity and resilience

If you’re responsible for third-party risk, this episode will help you step back and ask a harder question:

👉 Are you assessing vendors… or actually understanding your exposure?

🎧 Enjoying the podcast?
Explore more resources, expert insights, and certification programs at www.thirdpartyriskinstitute.com

📱 Follow us on LinkedIn for real-world conversations and industry trends: Third Party Risk Institute Ltd.

📬 Have a question or topic you'd like us to cover?
Email us at: info@thirdpartyriskinstitute.com