In this episode of The Third Party Risk Institute Podcast, host Linda Tuck Chapman speaks with Dasha Gorovenco, Executive Director in EY Ireland’s audit practice, about what effective artificial intelligence governance looks like through an external auditor’s lens.

Dasha explains why documentation is not the same as evidence, why AI ownership must exist in practice rather than only on paper, and why organizations need to know which AI systems are actually operating across their networks not simply which tools were approved or listed in a vendor contract.

Together, Linda and Dasha discuss AI audit evidence, third-party and fourth-party AI risk, SOC and ISO compliance, AI inventories, model testing, regulatory readiness, data sovereignty, cybersecurity risk, and operational resilience.

What we cover in this episode:

• What external auditors assess when reviewing an AI governance program
 • Why policies, contracts, meeting invitations, and process documents do not necessarily prove that controls are operating effectively
 • How to define practical AI ownership across business teams, technology, risk, compliance, users, and senior leadership
 • Why one Chief AI Officer or AI Risk Officer cannot own every aspect of AI risk
 • How organizations can identify approved and unapproved AI within third-party products, software, cloud environments, and business processes
 • How functionality-based questions can help identify AI embedded within vendor products and services
 • Why SOC reports may not provide sufficient assurance over AI-specific controls
 • The growing need for AI inventories, AI Bills of Materials, monitoring, and fourth-party visibility
 • Why dynamic AI systems, large language models, algorithms, and automated decisions require ongoing testing
 • How organizations can assess AI-generated errors, model bias, inconsistent outputs, and control failures
 • What the EU AI Act, DORA, GDPR, and data-sovereignty requirements mean for global organizations
 • How AI governance, cybersecurity risk, regulatory compliance, and operational resilience are connected

This episode is perfect for:

• Board members, Chief Risk Officers, Chief Audit Executives, CISOs, CIOs, and AI governance leaders
 • Internal Audit, IT Audit, Risk, Compliance, GRC, and Assurance Professionals
 • Third-Party Risk Management and Vendor Risk Management Professionals
 • Procurement, Cybersecurity, Privacy, Data Governance, and Model Risk Teams
 • Professionals responsible for AI controls, regulatory compliance, operational resilience, and third-party oversight
 • Organizations implementing or purchasing AI-enabled products and services

🎧 Enjoying the podcast?
Explore more resources, expert insights, and certification programs at www.thirdpartyriskinstitute.com

📱 Follow us on LinkedIn for real-world conversations and industry trends: Third Party Risk Institute Ltd.

📬 Have a question or topic you'd like us to cover?
 Email us at: [email protected]

In this episode of The Third Party Risk Institute Podcast, Linda Tuck Chapman speaks with Daniel Liu, Managing Director of Enterprise Risk Management at TMX Group, about what effective third-party risk management really looks like inside complex, regulated organizations.

Daniel shares practical insights from his experience across enterprise risk management, operational risk, financial services, data analytics, and regulatory environments. The conversation explores how operational risk and TPRM functions should work together, why risk culture matters, and why risk teams must move beyond checklists, policies, and one-time due diligence.

This episode covers key topics including third-party risk management, operational risk management, enterprise risk management, vendor segmentation, concentration risk, fourth-party risk, exit planning, regulatory expectations, operational resilience, OSFI expectations, first line and second line responsibilities, ongoing monitoring, and risk-based due diligence.

Listeners will also hear why vendor segmentation should be based on criticality and inherent risk, not spend or relationship history, and why overlooked risks such as exit risk, subcontractor exposure, change in control, and scope creep can create serious operational and regulatory challenges.

This is a valuable conversation for risk leaders, TPRM professionals, procurement teams, compliance officers, auditors, financial services executives, and anyone responsible for building stronger third-party risk and operational resilience programs.

🎧 Enjoying the podcast?
Explore more resources, expert insights, and certification programs at www.thirdpartyriskinstitute.com

📱 Follow us on LinkedIn for real-world conversations and industry trends: Third Party Risk Institute Ltd.

📬 Have a question or topic you'd like us to cover?
 Email us at: [email protected]

Third-party risk is no longer something organizations can review once a year and file away for audit season. Vendor incidents now move in hours, regulators expect stronger oversight, and a single provider can disrupt hundreds of businesses at once.

In this episode of the Third Party Risk Institute Podcast, we discuss why traditional annual questionnaires are falling short and why continuous third-party risk monitoring is becoming a core expectation for risk, procurement, compliance, cybersecurity, and vendor management teams.

We cover what continuous monitoring really means, why security ratings should be treated as early-warning signals rather than final answers, and how organizations can monitor vendor risk across cybersecurity, operational resilience, financial health, concentration risk, fourth-party risk, and AI-related vendor exposure.

You’ll also hear practical insights on DORA, NIST CSF 2.0, U.S. banking guidance, security ratings, KRIs, vendor risk dashboards, concentration risk, and the operating model needed to turn alerts into action.

If your organization still relies heavily on point-in-time assessments, spreadsheets, or annual vendor reviews, this episode will help you rethink what effective third-party risk management should look like in 2026.

🎧 Enjoying the podcast?
Explore more resources, expert insights, and certification programs at www.thirdpartyriskinstitute.com

📱 Follow us on LinkedIn for real-world conversations and industry trends: Third Party Risk Institute Ltd.

📬 Have a question or topic you'd like us to cover?
 Email us at: [email protected]

Third-party risk management is changing fast. For years, many organizations have relied on questionnaires, point-in-time assessments, manual workflows, and fragmented ownership across procurement, cyber, compliance, resilience, privacy, model risk, and business teams. But with AI, cyber ratings, data ecosystems, shared assessments, trust centers, regulatory pressure, and operational resilience expectations becoming more important, the future of TPRM is moving beyond traditional vendor due diligence.

In this episode of the Third Party Risk Institute Podcast, Linda Tuck Chapman speaks with Matthew Moog, Principal of Risk Managed Services at EY, about where third-party risk management is heading and what risk professionals need to understand now. Matt shares lessons from his career across EY, TrueSight, and OneTrust, including the challenges of standardizing assessments, building shared third-party risk utilities, using data before sending questionnaires, and rethinking how organizations assess, monitor, and respond to supplier risk.

This conversation explores some of the biggest issues facing risk, procurement, cybersecurity, compliance, and operational resilience teams today, including:

•  Why traditional third-party risk assessments are no longer enough 
•  How AI and automation may change vendor risk management workflows 
•  Why the future of TPRM depends on better data, not more questionnaires 
•  The role of cyber ratings, trust centers, attestations, certifications, and standardized data 
•  How organizations can reduce fragmented third-party risk processes 
•  Why operational resilience, fourth-party risk, and dependency mapping are becoming critical 
•  How DORA, regulatory expectations, and global financial services guidance are shaping TPRM 
•  Why human judgment still matters in an AI-enabled risk environment 
•  What risk professionals should focus on to build a stronger career in TPRM 

Matt also shares practical career advice for professionals entering or growing in third-party risk management, operational risk, cyber risk, vendor risk, and governance roles.

This episode is essential listening for anyone working in third-party risk management, vendor risk management, supplier risk, operational resilience, cybersecurity risk, regulatory compliance, procurement, financial services risk, AI governance, fourth-party risk, or enterprise risk management.

🎧 Enjoying the podcast?
Explore more resources, expert insights, and certification programs at www.thirdpartyriskinstitute.com

📱 Follow us on LinkedIn for real-world conversations and industry trends: Third Party Risk Institute Ltd.

📬 Have a question or topic you'd like us to cover?
 Email us at: [email protected]

The first four months of 2026 have already reshaped how organizations think about third-party risk.

From regulatory pressure like Digital Operational Resilience Act to the rapid adoption of AI across vendor ecosystems, the gap between what organizations assess and what they actually understand is becoming more visible and more risky.

In this episode, we break down what’s actually changed in third-party risk so far this year, not at a theoretical level, but based on real developments, regulatory shifts, and operational challenges organizations are facing right now.

This is not a high-level conversation. This is a practical review of where programs are falling short and what needs to change.

What We Cover in This Episode

•  Why traditional third-party risk models are failing in 2026 
•  The growing disconnect between vendor assessments and real-world dependencies 
•  How AI adoption is introducing new, unmeasured risks in third-party ecosystems 
•  What regulators are actually expecting (and where organizations are still behind) 
•  The rise of concentration risk, fourth-party risk, and infrastructure dependencies 
•  Why business continuity assumptions are no longer holding up 
•  What strong third-party risk programs are starting to do differently 
•  Practical steps to rethink your approach, immediately 

Who This Podcast Is For

•  Third-Party Risk Managers 
•  Vendor & Supplier Risk Professionals 
•  Procurement Leaders 
•  Operational Risk & Resilience Teams 
•  Compliance and Audit Professionals 
•  Anyone responsible for understanding how third parties impact business continuity and resilience 

If you’re responsible for third-party risk, this episode will help you step back and ask a harder question:

👉 Are you assessing vendors… or actually understanding your exposure?

🎧 Enjoying the podcast?
Explore more resources, expert insights, and certification programs at www.thirdpartyriskinstitute.com

📱 Follow us on LinkedIn for real-world conversations and industry trends: Third Party Risk Institute Ltd.

📬 Have a question or topic you'd like us to cover?
 Email us at: [email protected]

In this episode of the Third Party Risk Institute Podcast, Linda Tuck Chapman speaks with Elina Moshkovich, an independent Governance, Risk, and Compliance (GRC) advisor based in Dubai, about one of the most overlooked areas of modern risk management risk governance systems.

While many organizations invest heavily in risk frameworks, tools, and compliance programs, they often fail to address the governance structures that determine how decisions are made and how risks are escalated.

Drawing on experience as a Chief Risk Officer and GRC advisor, Elina shares practical insights into how companies can design governance systems that actually work.

In this conversation, we explore:

• Why risk governance frameworks often fail inside organizations
 • The connection between operational risk, third-party risk, and organizational strategy
 • How governance gaps can create major risk exposures
 • A real-world example of a vendor failure that could have been prevented with better governance
 • Why risk culture and escalation practices are critical for protecting organizations
 • The growing importance of third-party risk management in an interconnected economy
 • The difference between principles-based regulations and prescriptive regulations like DORA
 • How companies should start thinking about AI governance and acceptable AI use policies
 • Skills and career advice for professionals entering risk management, compliance, and GRC roles

This episode is particularly valuable for professionals working in:

• Risk Management
• Governance, Risk & Compliance (GRC)
• Third-Party Risk Management (TPRM)
• Operational Risk
• Cybersecurity Risk
• Regulatory Compliance

As organizations become more dependent on external vendors, digital systems, and AI tools, effective governance is becoming the foundation of resilient risk management programs.

🎧 Enjoying the podcast?
Explore more resources, expert insights, and certification programs at www.thirdpartyriskinstitute.com

📱 Follow us on LinkedIn for real-world conversations and industry trends: Third Party Risk Institute Ltd.

📬 Have a question or topic you'd like us to cover?
 Email us at: [email protected]

DORA is now in force, and the first full year of implementation (2025) revealed what’s working and where firms are still struggling. In this episode, Third Party Risk Institute breaks down the current state of DORA in 2026 with global takeaways for third-party risk, ICT risk management, incident reporting, resilience testing, and oversight of critical technology providers.

We cover what organizations across financial services, tech, healthcare, and consulting did in 2025 to meet expectations, what best practices are emerging, and how risk professionals are adapting through stronger governance, better vendor visibility, contract upgrades, and more realistic testing programs.

If you work in TPRM / vendor risk, operational resilience, cyber risk, procurement, compliance, or audit, this is a practical, high-level briefing you can apply immediately.

Topics include:

• DORA pillars explained: ICT risk, incident reporting, testing, third-party risk, info sharing
• What “good” looks like in 2026 (and what still breaks under pressure)
• Critical vendor oversight and subcontractor / fourth-party visibility
• Common implementation gaps and how teams are closing them
• Tools, operating models, and skills risk professionals are leaning on

If you are in DORA or are responsible for DORA, you can now get Certified via Certified DORA Practitioner (CDP) live stream training from Third Party Risk Institute. More details here: https://thirdpartyriskinstitute.com/dora/

🎧 Enjoying the podcast?
Explore more resources, expert insights, and certification programs at www.thirdpartyriskinstitute.com

📱 Follow us on LinkedIn for real-world conversations and industry trends: Third Party Risk Institute Ltd.

📬 Have a question or topic you'd like us to cover?
 Email us at: [email protected]

2025 reshaped how organizations view third-party cyber risk. In this deep-dive episode, we analyze the real incidents that caused operational shutdowns across healthcare, aviation, manufacturing, and financial services.

You’ll hear how:

• The Change Healthcare ransomware attack exposed up to 190 million records and triggered a multi-billion-dollar disruption
• Jaguar Land Rover suffered a six-week global production halt due to a vendor cyber incident
• Airlines faced airport gridlock after a single IT supplier failure
• Cloud misconfigurations leaked millions of healthcare records
• Stolen credentials and MFA bypass techniques accelerated account takeovers
• CLOP ransomware exploited zero-day vulnerabilities in file transfer and ERP systems
• Regulators enforced DORA and NIS2 accountability for vendor risk
• AI-driven cyber attacks are emerging as the next threat wave

This episode connects cyber risk directly to business continuity, operational resilience, regulatory compliance, and vendor governance, critical insights for risk leaders, CISOs, compliance teams, procurement professionals, and third-party risk practitioners.

🎧 Listen to understand why vendor ecosystems now represent the single largest source of enterprise risk and what organizations must prioritize going into 2026.

🎧 Enjoying the podcast?
Explore more resources, expert insights, and certification programs at www.thirdpartyriskinstitute.com

📱 Follow us on LinkedIn for real-world conversations and industry trends: Third Party Risk Institute Ltd.

📬 Have a question or topic you'd like us to cover?
 Email us at: [email protected]

In this in-depth episode of The Third Party Risk Institute Podcast, we take a hard look at how the Digital Operational Resilience Act (DORA) is fundamentally changing expectations for third-party risk, cybersecurity, procurement, compliance, and governance teams.

Rather than treating DORA as another regulatory checkbox, this episode focuses on what DORA will expose inside most third-party risk management programs including gaps that many organizations are not yet prepared to defend during regulatory inspections.

This conversation goes beyond regulatory summaries. We break down the organizational, operational, and technical impact of DORA, and explain why many existing TPRM programs will struggle to meet the “prove it” resilience standard regulators are now enforcing.

Together, we unpack:

• Why DORA is not just an ICT regulation, but a resilience mandate
• How third-party risk programs are being stress-tested for the first time
• Where vendor oversight, incident response, and exit strategies fall short
• Why policies alone will no longer satisfy regulators
• How real third-party failures explain why DORA exists

We also examine real-world third-party incidents and outages to show how concentration risk, fourth-party exposure, and untested recovery assumptions can quickly become systemic failures.

What We Cover in This Episode

• What DORA will expose in most third-party risk management programs
• Why operational resilience is replacing checkbox compliance
• How DORA reshapes expectations for vendor oversight and governance
• The most common gaps in third-party risk, incident response, and resilience testing
• Why dependency mapping and critical service identification are failing points
• How vendor concentration and fourth-party risk are coming under scrutiny
• What regulators expect organizations to prove, not just document
• Why exit strategies and substitutability matter more than ever
• Lessons from real-world third-party outages and cyber incidents
• How organizations should prepare for DORA inspections and audits

This Episode Is Essential For:

• Chief Risk Officers (CROs) and Operational Resilience Leaders
• Third-Party Risk and Vendor Risk Management Professionals
• Cybersecurity and ICT Risk Teams
• Procurement and Strategic Sourcing Leaders
• Compliance and Governance Professionals
• Executives accountable for regulatory readiness and resilience

If your intrested in learning about DORA and getting certified check out our upcoming live class: https://thirdpartyriskinstitute.com/dora/

🎧 Enjoying the podcast?
Explore more resources, expert insights, and certification programs at www.thirdpartyriskinstitute.com

📱 Follow us on LinkedIn for real-world conversations and industry trends: Third Party Risk Institute Ltd.

📬 Have a question or topic you'd like us to cover?
 Email us at: [email protected]

In this landmark episode of The Third Party Risk Institute Podcast – The Executive Edge, we sit down with Nathan Spielberg, Co-Founder and Chief Technology Officer of Tamarin AI, for an in-depth and highly practical conversation on how artificial intelligence is truly built, trained, and deployed in enterprise procurement and third-party risk environments.

With a PhD from Stanford University, a Master’s in Mechanical Engineering and Machine Learning, and an undergraduate degree from MIT, Nathan brings rare technical depth combined with real-world enterprise application experience. His work spans machine learning, autonomous systems, reinforcement learning, and AI-driven procurement intelligence.

This episode goes far beyond surface-level AI discussions. Together, we unpack:

• How AI models are actually built
• Why data quality determines everything
• How algorithms, training, and evaluation really work
• Where the biggest hidden enterprise risks live
• Why “AI inside your organization” does NOT automatically mean it is secure

We also explore how AI is reshaping procurement decision-making, where organizations are unknowingly exposed through fourth-party AI model dependencies, and why explainability and continuous validation are becoming regulatory and board-level concerns.

What We Cover in This Episode

• How AI models, algorithms, and data interact inside enterprise systems
• The real difference between supervised, unsupervised, and reinforcement learning
• Why most organizations underestimate AI risk inside their procurement and vendor platforms
• How training, fine-tuning, retrieval, and model evaluation actually work
• Why “garbage in, garbage out” is the single biggest AI failure point
• The hidden fourth-party risk created by outsourced AI models
• Why explainability remains one of the hardest unresolved challenges in AI
• How organizations should think about continuous AI testing and performance drift
• The growing importance of AI bills of materials and model transparency
• Key public AI risk intelligence sources every risk leader should monitor

This Episode Is Essential For:

• Chief Risk Officers (CROs) and Chief Information Officers (CIOs)
• Chief Procurement Officers and Strategic Sourcing Leaders
• Third-Party Risk and Vendor Risk Management Professionals
• Cybersecurity, Data Governance, and Model Risk Teams
• Compliance Leaders preparing for AI regulatory expectations
• Executives evaluating AI-enabled procurement and vendor platforms

🎧 Enjoying the podcast?
Explore more resources, expert insights, and certification programs at www.thirdpartyriskinstitute.com

📱 Follow us on LinkedIn for real-world conversations and industry trends: Third Party Risk Institute Ltd.

📬 Have a question or topic you'd like us to cover?
 Email us at: [email protected]