In this in-depth episode of The Third Party Risk Institute Podcast, we take a hard look at how the Digital Operational Resilience Act (DORA) is fundamentally changing expectations for third-party risk, cybersecurity, procurement, compliance, and governance teams.

Rather than treating DORA as another regulatory checkbox, this episode focuses on what DORA will expose inside most third-party risk management programs including gaps that many organizations are not yet prepared to defend during regulatory inspections.

This conversation goes beyond regulatory summaries. We break down the organizational, operational, and technical impact of DORA, and explain why many existing TPRM programs will struggle to meet the “prove it” resilience standard regulators are now enforcing.

Together, we unpack:

• Why DORA is not just an ICT regulation, but a resilience mandate
• How third-party risk programs are being stress-tested for the first time
• Where vendor oversight, incident response, and exit strategies fall short
• Why policies alone will no longer satisfy regulators
• How real third-party failures explain why DORA exists

We also examine real-world third-party incidents and outages to show how concentration risk, fourth-party exposure, and untested recovery assumptions can quickly become systemic failures.

What We Cover in This Episode

• What DORA will expose in most third-party risk management programs
• Why operational resilience is replacing checkbox compliance
• How DORA reshapes expectations for vendor oversight and governance
• The most common gaps in third-party risk, incident response, and resilience testing
• Why dependency mapping and critical service identification are failing points
• How vendor concentration and fourth-party risk are coming under scrutiny
• What regulators expect organizations to prove, not just document
• Why exit strategies and substitutability matter more than ever
• Lessons from real-world third-party outages and cyber incidents
• How organizations should prepare for DORA inspections and audits

This Episode Is Essential For:

• Chief Risk Officers (CROs) and Operational Resilience Leaders
• Third-Party Risk and Vendor Risk Management Professionals
• Cybersecurity and ICT Risk Teams
• Procurement and Strategic Sourcing Leaders
• Compliance and Governance Professionals
• Executives accountable for regulatory readiness and resilience

If your intrested in learning about DORA and getting certified check out our upcoming live class: https://thirdpartyriskinstitute.com/dora/

🎧 Enjoying the podcast?
Explore more resources, expert insights, and certification programs at www.thirdpartyriskinstitute.com

📱 Follow us on LinkedIn for real-world conversations and industry trends: Third Party Risk Institute Ltd.

📬 Have a question or topic you'd like us to cover?
Email us at: [email protected]

In this landmark episode of The Third Party Risk Institute Podcast – The Executive Edge, we sit down with Nathan Spielberg, Co-Founder and Chief Technology Officer of Tamarin AI, for an in-depth and highly practical conversation on how artificial intelligence is truly built, trained, and deployed in enterprise procurement and third-party risk environments.

With a PhD from Stanford University, a Master’s in Mechanical Engineering and Machine Learning, and an undergraduate degree from MIT, Nathan brings rare technical depth combined with real-world enterprise application experience. His work spans machine learning, autonomous systems, reinforcement learning, and AI-driven procurement intelligence.

This episode goes far beyond surface-level AI discussions. Together, we unpack:

• How AI models are actually built
• Why data quality determines everything
• How algorithms, training, and evaluation really work
• Where the biggest hidden enterprise risks live
• Why “AI inside your organization” does NOT automatically mean it is secure

We also explore how AI is reshaping procurement decision-making, where organizations are unknowingly exposed through fourth-party AI model dependencies, and why explainability and continuous validation are becoming regulatory and board-level concerns.

What We Cover in This Episode

• How AI models, algorithms, and data interact inside enterprise systems
• The real difference between supervised, unsupervised, and reinforcement learning
• Why most organizations underestimate AI risk inside their procurement and vendor platforms
• How training, fine-tuning, retrieval, and model evaluation actually work
• Why “garbage in, garbage out” is the single biggest AI failure point
• The hidden fourth-party risk created by outsourced AI models
• Why explainability remains one of the hardest unresolved challenges in AI
• How organizations should think about continuous AI testing and performance drift
• The growing importance of AI bills of materials and model transparency
• Key public AI risk intelligence sources every risk leader should monitor

This Episode Is Essential For:

• Chief Risk Officers (CROs) and Chief Information Officers (CIOs)
• Chief Procurement Officers and Strategic Sourcing Leaders
• Third-Party Risk and Vendor Risk Management Professionals
• Cybersecurity, Data Governance, and Model Risk Teams
• Compliance Leaders preparing for AI regulatory expectations
• Executives evaluating AI-enabled procurement and vendor platforms

🎧 Enjoying the podcast?
Explore more resources, expert insights, and certification programs at www.thirdpartyriskinstitute.com

📱 Follow us on LinkedIn for real-world conversations and industry trends: Third Party Risk Institute Ltd.

📬 Have a question or topic you'd like us to cover?
Email us at: [email protected]

In this episode of The Third Party Risk Institute Podcast, we sit down with Kenia Sposito, Head of Operational Risk at BNP Paribas Canada, for a deep dive into how one of the world’s largest and most complex banks approaches third-party and fourth-party risk. With more than 12 years at BNP Paribas and experience spanning JP Morgan, Crédit Agricole, and global markets operations, Kenia offers a grounded, inside view of what it truly takes to oversee operational risk across multiple jurisdictions, regulatory regimes, and shared-services operating models.

Kenia shares how BNP Paribas Canada serves as a major service hub for the Americas, why third-party risk is fundamentally a “team sport,” and how global institutions harmonize risk expectations from Canada’s OSFI B-10 to Europe’s DORA to U.S. supervisory requirements. She also breaks down the realities of managing affiliate risk, understanding data flows, responding to incidents, and keeping the business aligned with operational risk expectations without slowing down delivery.

What we cover in this episode:
• Why operational risk, third-party risk, privacy, cybersecurity, compliance, and legal must work as a unified ecosystem
• How BNP Paribas evaluates affiliate-delivered services and why internal shared services still count as third parties under regulation
• The difference between spend, risk, and operational dependency why most organizations mix them up
• Why data flow risk is one of the most misunderstood areas in vendor oversight
• How global banks reconcile prescriptive frameworks like EU DORA with principles-based guidance such as OSFI B-10
• What meaningful fourth-party oversight actually looks like in practice
• Why culture, transparency, and responsiveness matter just as much as controls in a third-party relationship
• How operational risk leaders balance independence, efficiency, and business partnership

You’ll walk away with practical guidance on:
• Segmenting third parties using operational dependency instead of generic “criticality” labels
• Assessing affiliate risk and building a consistent view of controls across internal and external service providers
• Applying smarter due diligence by focusing on the pillars that actually matter: data use, access, security, and resilience
• Creating repeatable governance for tracking fourth parties and identifying when they pose material risk
• Designing escalation paths and decision frameworks that help business leaders make truly risk-informed decisions
• Strengthening resilience by learning from incidents and adapting processes rather than “checking boxes”
• Using negative news monitoring, financial health checks, and cyber posture metrics for high-risk fourth parties

This episode is perfect for:
• CROs, Operational Risk Leaders, and Senior Risk Managers in global financial services
• Third-Party Risk, Vendor Management, and Procurement professionals
• Compliance, Data Privacy, Cybersecurity, and Governance teams
• Anyone responsible for building resilient, multi-jurisdictional risk frameworks
• Practitioners navigating DORA, OSFI B-10, U.S. Interagency Guidance, or other regulatory expectations

🎧 Enjoying the podcast?
Explore more resources, expert insights, and certification programs at www.thirdpartyriskinstitute.com

📱 Follow us on LinkedIn for real-world conversations and industry trends: Third Party Risk Institute Ltd.

📬 Have a question or topic you'd like us to cover?
Email us at: [email protected]

In this episode of The Third Party Risk Institute Podcast, we sit down with Matthew Moore, Director of Operational Risk at Barclays Bank in New York, to explore the complexities of third-party risk management beyond traditional vendor oversight. With more than two decades of global experience in operational risk across investment banking and capital markets, Matthew offers a rare insider’s view on managing systemic dependencies, non-vendor third parties, and regulatory expectations.

Drawing on his role overseeing operational risk for Barclays’ U.S. markets, Matthew explains why financial market infrastructures (FMIs), clearinghouses, and mandated service providers represent some of the most critical and misunderstood third-party relationships. He highlights how a principles-based approach to risk, coupled with resilience planning, is essential to protecting organizations when concentration risks and outages occur.

What we cover in this episode:
• The difference between vendor vs. non-vendor third parties and why both require tailored oversight
• How CCPs, FMIs, and exchanges create systemic dependencies for banks and other financial institutions
• The challenges of applying traditional due diligence when third parties set the rulebook, not the bank
• The role of scenario analysis and resilience playbooks in addressing outages and concentration risk
• Global regulatory expectations, from U.S. Interagency Guidance to UK PRA outsourcing rules to EU DORA
• Why operational risk teams must balance independence with collaboration to drive better business outcomes

You’ll walk away with practical guidance on:
• Designing third-party frameworks that flex between vendor and non-vendor relationships
• Building resilience through updated playbooks, outage planning, and scenario exercises
• Using industry forums, governance committees, and public disclosures to bridge information gaps
• Creating transparency in risk reporting, escalation, and board-level decision making
• Recognizing when concentration risks demand alternative providers, and when they don’t exist

This episode is perfect for:
• CROs, Heads of Operational Risk, and Risk Managers in banking and financial services
• Third-Party Risk, Procurement, and Vendor Management Leaders
• Compliance, Audit, and Governance Professionals facing regulatory scrutiny
• Anyone looking to understand how operational resilience and systemic dependencies intersect with third-party risk

🎧 Enjoying the podcast?
Explore more resources, expert insights, and certification programs at www.thirdpartyriskinstitute.com

📱 Follow us on LinkedIn for real-world conversations and industry trends: Third Party Risk Institute Ltd.

📬 Have a question or topic you'd like us to cover?
Email us at: [email protected]

In this episode of The Third Party Risk Institute Podcast, we tackle one of the most urgent challenges in risk management today: artificial intelligence entering your organization through third-party vendors. AI promises efficiency and insights, but behind the buzzwords lie hidden risks that can compromise compliance, trust, and resilience.

We break down the building blocks of AI data, algorithms, and infrastructure to show you where vulnerabilities really start, and how to ask the right due diligence questions before onboarding an “AI-powered” vendor. From model drift and explainability gaps to cloud concentration and fourth- and fifth-party dependencies, this episode arms you with the literacy needed to separate hype from reality.

What we cover in this episode:
 • The “black box” problem in AI and why explainability is a regulatory must-have
 • Key risks in data provenance, model drift, adversarial attacks, and bias amplification
 • How hyperscale cloud reliance creates hidden concentration risk for enterprises
 • The overlooked fourth- and fifth-party risks in AI supply chains
 • Practical due diligence questions to embed in RFPs and vendor questionnaires
 • How regulators from the EU AI Act to U.S. financial agencies are already shaping expectations

You’ll walk away with practical guidance on:
 • Identifying red flags in vendor claims about AI
 • Shifting from one-time reviews to continuous monitoring of AI vendors
 • Embedding AI-specific obligations into contracts, including audit rights and incident reporting
 • Building functional literacy so you can challenge vendors and protect your organization

This episode is perfect for:
 • Third-Party Risk Management, Procurement, and Compliance Leaders
 • CROs, CISOs, and Risk Executives navigating AI-driven vendor ecosystems
 • Internal Audit, Legal, and Governance Professionals under regulatory pressure
 • Anyone seeking to translate AI complexity into concrete risk oversight

🎧 Enjoying the podcast?
Explore more resources, expert insights, and certification programs at www.thirdpartyriskinstitute.com

📱 Follow us on LinkedIn for real-world conversations and industry trends: Third Party Risk Institute Ltd.

📬 Have a question or topic you'd like us to cover?
Email us at: [email protected]

In this episode of The Third Party Risk Institute Podcast, we sit down with Shagen Ganason, Group Chief Auditor at Liva Group, to explore the evolving role of internal audit, the impact of regulatory diversity, and why third-party accountability can never be outsourced. With over 30 years of leadership experience across insurance, banking, aviation, manufacturing, and the public sector, and having worked in seven countries, Shagen brings a rare global perspective to audit, risk, and governance.

Drawing on his books The Storyteller’s Ledger and The Auditor’s Secret Weapon, Shagen shares how communication, storytelling, and cultural adaptability are becoming essential skills for auditors and risk leaders. He also highlights why regulators in regions like the GCC are moving fast on cybersecurity, outsourcing oversight, and financial crime risks, and what that means for boards and executives.

What we cover in this episode:
• The three dimensions of modern internal audit: assurance, advisory, and strategic oversight
• How principles-based vs. prescriptive regulations shape audit and compliance practices across countries
• Building resilience through risk culture, and why it looks different in New Zealand, Korea, and the Middle East
• The link between risk appetite and corporate strategy, and how boards translate it into actionable decisions
• Concentration risk, fourth-party dependencies, and why cloud reliance creates hidden exposures
• Why accountability for third-party risk can never be outsourced, and how boards and auditors should address it

You’ll walk away with practical guidance on:
• Communicating audit findings through storytelling that sticks and drives action
• Aligning audit plans with organizational strategy and risk appetite
• Building credibility and independence while maintaining strong business relationships
• Understanding how regulatory diversity and cultural context influence governance effectiveness

This episode is perfect for:
• Chief Audit Executives, CROs, and Board Members
• Internal Audit, Compliance, and Risk Professionals
• Procurement and Vendor Risk Leaders facing regulatory scrutiny
• Anyone looking to strengthen their understanding of risk culture, assurance, and third-party accountability

🎧 Enjoying the podcast?
Explore more resources, expert insights, and certification programs at www.thirdpartyriskinstitute.com

📱 Follow us on LinkedIn for real-world conversations and industry trends: Third Party Risk Institute Ltd.

📬 Have a question or topic you'd like us to cover?
Email us at: [email protected]

In this episode of The Third Party Risk Institute Podcast, we take a deep dive into the three landmark regulations set to redefine cybersecurity and third-party risk management (TPRM) in 2025:

• DORA (EU Digital Operational Resilience Act) – binding requirements for financial institutions and ICT providers, including detailed vendor contract clauses, unrestricted audit rights, and concentration risk analysis.
• NIS2 Directive – expanding cybersecurity obligations across 18 critical sectors with strict incident reporting timelines, supplier security expectations, and senior management accountability.
• U.S. SEC Cybersecurity Disclosure Rule – mandating public companies to disclose material cyber incidents within four days and report annually on vendor cyber risk management practices.

Together, these regulations signal a global shift: cyber resilience and third-party risk oversight are now board-level imperatives.

What we cover in this episode:
• Key contract clauses and due diligence steps required by DORA
• How NIS2 expands supply chain risk accountability beyond finance
• Why SEC rules make vendor cyber incidents investor disclosures
• Practical ways to embed vendor oversight into enterprise risk programs
• Actionable steps for CROs, CISOs, and TPRM teams to stay compliant

You’ll walk away with practical guidance on:
• Performing a regulatory gap analysis across DORA, NIS2, and SEC rules
• Updating vendor contracts with notification, audit, and cooperation clauses
• Building a structured supply chain security program aligned with ISO 27001 and NIST CSF
• Preparing disclosure processes and templates to meet SEC 8-K reporting deadlines
• Using certifications like C3PRMP to build in-house expertise and demonstrate readiness

This episode is essential listening for:
• Chief Risk Officers, CISOs, Vendor Risk Managers, and Procurement Leaders
• Cybersecurity, Compliance, and Audit Professionals
• Board Members and Executives overseeing enterprise resilience

By embracing these regulatory changes, you won’t just avoid penalties, you’ll strengthen trust, enhance resilience, and gain a competitive edge in today’s interconnected economy

🎧 Enjoying the podcast?
Explore more resources, expert insights, and certification programs at www.thirdpartyriskinstitute.com

📱 Follow us on LinkedIn for real-world conversations and industry trends: Third Party Risk Institute Ltd.

📬 Have a question or topic you'd like us to cover?
Email us at: [email protected]

Contracts are often seen as the backbone of third-party relationships, but are they really protecting your organization from risk? In this episode, Linda Tuck Chapman sits down with Lawrence Kane and Jeanette Nyden to explore how contractual terms, governance, and negotiation strategies shape third-party risk management in practice.

You’ll walk away with practical guidance on:
 • Understanding why risk cannot be fully “transferred” and what controls actually work
 • Embedding business continuity, resilience, and performance obligations into contracts
 • Navigating liability limits, indemnities, and warranties with real-world examples
 • Knowing when to renegotiate, amend, or exit contracts responsibly
 • Aligning procurement, legal, and risk functions for stronger vendor oversight

This episode is perfect for:
 • Contract Managers, Procurement Leaders, and Vendor Risk Managers
 • Third-Party Risk, Compliance, and Governance Professionals
 • Legal, Audit, and Operations Executives dealing with complex supplier contracts
 • Anyone responsible for protecting their organization from contract-related risk exposure

🎧 Enjoying the podcast?
Explore more resources, expert insights, and certification programs at www.thirdpartyriskinstitute.com

📱 Follow us on LinkedIn for real-world conversations and industry trends: Third Party Risk Institute Ltd.

📬 Have a question or topic you'd like us to cover?
Email us at: [email protected]

In this episode of The Third Party Risk Institute Podcast, host Linda Tuck Chapman sits down with Stanley Lee, CEO and Founder of Net Switch, to explore how artificial intelligence (AI) and cybersecurity are transforming third-party risk management (TPRM).

With decades of experience in global technology, cyber governance, and workforce development, Stanley shares real-world lessons on how organizations can strengthen defenses, reduce vulnerabilities, and prepare for regulatory expectations. Together, we break down how AI tools, software bills of materials (SBOMs), and augmented intelligence (“human in the loop”) are changing the way businesses safeguard critical vendor relationships.

What we cover in this episode:
• Why CEOs remain uncertain about cybersecurity priorities and investment levels
• The role of AI in anomaly detection, false positive reduction, and continuous monitoring
• How to integrate SBOMs and penetration testing into your third-party oversight
• The importance of model risk management and independent validation of AI models
• Lessons from Target, SolarWinds, and Log4j for today’s supply chain and vendor oversight
• Building guardrails for ethical AI, governance, and executive decision-making

You’ll walk away with practical guidance on:
• Applying “trust but verify” to third-party AI solutions
• Defining KPIs that link cybersecurity investment to risk appetite
• Leveraging open-source tools and frameworks like MITRE ATT&CK for continuous resilience
• Becoming the “human in the loop” to ensure accountability and critical oversight

This episode is perfect for:
• Chief Risk Officers, CISOs, and Vendor Risk Managers
• Cybersecurity and Procurement Leaders
• Compliance, Audit, and Governance Professionals
• Anyone responsible for securing third-party ecosystems in highly regulated industries

If you like reading, check out our full blog post on AI, cybersecurity, and third-party resilience here: https://thirdpartyriskinstitute.com/modernizing-third-party-risk-management-with-ai/

🎧 Enjoying the podcast?
Explore more resources, expert insights, and certification programs at www.thirdpartyriskinstitute.com

📱 Follow us on LinkedIn for real-world conversations and industry trends: Third Party Risk Institute Ltd.

📬 Have a question or topic you'd like us to cover?
Email us at: [email protected]

In this episode of The Third Party Risk Institute Podcast, we explore how artificial intelligence is revolutionizing third-party risk management (TPRM) by shifting from outdated, static assessments to continuous, real-time monitoring. With third-party data breaches projected to impact over 60% of companies by 2025, this transformation is no longer optional it’s a regulatory and operational necessity.

Drawing from global regulatory trends, case examples, and emerging best practices, we break down how AI-powered TPRM enables organizations to detect issues faster, map fourth-party dependencies, assess ESG risks, and build resilience into complex supply chains. You’ll hear how machine learning, natural language processing, and anomaly detection are enhancing due diligence, automating risk scoring, and integrating real-time risk intelligence into procurement and governance.

What we cover in this episode:
• Why traditional annual vendor assessments no longer work in today’s fast-moving threat environment
• How AI enables continuous monitoring and dynamic risk scoring
• Techniques to map and manage fourth-party and concentration risk
• Integrating ESG risk into TPRM programs
• Key regulatory drivers including DORA, the EU AI Act, APRA CPS 234, and U.S. Interagency Guidance
• Best practices for AI governance and human oversight

You’ll walk away with practical guidance on:
• Building an integrated data foundation for continuous monitoring
• Selecting and deploying AI-enabled TPRM platforms
• Aligning your TPRM program with evolving global regulations
• Avoiding pitfalls like poor data quality, false positives, and AI overreliance

This episode is perfect for:
• Chief Risk Officers, Vendor Risk Managers, and Procurement Leaders
• Cybersecurity, Compliance, and Audit Professionals
• ESG, Sustainability, and Governance Specialists
• Anyone tasked with safeguarding critical third-party relationships in regulated industries

If you like reading, check out our full blog post on Modernizing Third Party Risk Management with AI here: https://thirdpartyriskinstitute.com/modernizing-third-party-risk-management-with-ai/

🎧 Enjoying the podcast?
Explore more resources, expert insights, and certification programs at www.thirdpartyriskinstitute.com

📱 Follow us on LinkedIn for real-world conversations and industry trends: Third Party Risk Institute Ltd.

📬 Have a question or topic you'd like us to cover?
Email us at: [email protected]