The Current

Hello Risk Leader,

Welcome back to The Current, where we cut through the noise to highlight the risk and third-party management updates that actually matter. This edition tackles two connected problems: why TPRM teams are struggling with capacity despite years of hiring conversations, and whether the technology we're investing in is actually solving the right problems.

They turn out to be the same question. Is the program built to scale, or are we just running the old one faster?

Let's dive in. 🌊

What's New?

Quick question for your next headcount request. If you added two analysts tomorrow, would the program get better, or would the same problem just get spread across more people?

What changed.

The industry is finally talking about what practitioners have known for years. TPRM programs are carrying more vendors, more risk types, and more regulatory scrutiny than they were ever designed to handle. But the conversation keeps landing on headcount, and that's the wrong starting point. The real issue is the constant push and pull between three things: how many third parties are in scope, what type of service each provides, and the level of exposure each relationship creates. That combination sets the actual workload, and it shifts constantly.

A vendor manager "managing" 100+ relationships has very little time to do anything meaningful with any of them. They're updating spreadsheets, chasing responses, requesting documentation, and triaging the loudest fires. That's not risk management. It's an administrative game of hot potato, and no one wins. When monitoring, assessment, and governance weren't built to flex with the portfolio, adding headcount just distributes the same problem. You get three people raising their hand instead of one.

What didn't change.

The June 2023 Interagency Guidance from the OCC, FDIC, and Federal Reserve still expects banks to involve staff with the requisite knowledge and skills at every stage of the lifecycle: planning, due diligence, contract negotiation, ongoing monitoring, and termination. That's reasonable in principle, but it assumes program infrastructure that may not have adapted since it was built. The standard hasn't changed. The vendor count (and type) has, and the gap keeps widening. Regulators also haven't backed away from treating capacity as the institution's problem. The OCC's November 2025 Request for Information on Community Banks acknowledged the difficulty of attracting and retaining skilled staff, tight budgets, and reduced bargaining power with dominant providers. Acknowledging the challenge isn't the same as lowering the bar.

What it means for business.

The conversation needs to shift from "we need more people" to "we need a program that works at this scale." Can your tiering tell a critical cloud provider from a low-risk office supply vendor without forcing the same manual process on both? Are you monitoring for meaningful change (incidents, control breakdowns, financial deterioration, subcontractor shifts, service issues) or repeating the same annual exercise? Does your governance push ownership into the business, while keeping centralized challenge for the relationships that truly matter?

The scalable answer is redesigning the operating model. Standardize oversight for low-risk vendors. Use trigger-based monitoring to catch material change. Treat critical relationships as a portfolio of concentration, dependency, and resilience risk. That gives the business speed where risk is low, and gives the central team room to focus where failure would actually matter.

OCC, Federal Reserve, FDIC Interagency Guidance on Third-Party Relationships: Risk Management (June 2023)
OCC, Request for Information on Community Bank Issues (November 2025)

Every product page says "AI powered." Every demo looks impressive. Here's the question that doesn't get asked enough: did the technology change how your program works, or did it just put the existing process on a better interface? Those are very different outcomes.

What changed.

The TPRM technology market has expanded significantly, and we love the new ideas. Platforms now offer automated intake, continuous monitoring feeds, AI-assisted questionnaire review, integrated contract management, and dashboards that slice risk data a dozen ways. Many of these are real progress, especially in reducing manual lift on intake, triage, and evidence collection. But too many programs took a process built around annual spreadsheets, migrated it into a platform, and called it transformation. Same questionnaire. Same cadence. Same tiering logic. Same bottlenecks. The only things that changed were the tool and the licensing cost. That's not innovation. That's digitization.

What didn't change.

The core operating model at most institutions still follows the pattern it did a decade ago. Onboard the vendor, send a questionnaire, review the responses, rate the risk, revisit annually. Technology made each step faster. It hasn't challenged whether those are the right steps, or whether that sequence reflects how risk actually moves.

What it means for business.

The investment is real and growing, but spending more doesn't automatically produce better outcomes. If the process is the problem, a better tool just helps you run the wrong process more efficiently. Faster questionnaires that still ask the wrong questions. Real-time dashboards nobody outside the risk team looks at. Monitoring feeds that generate alerts but no action, because escalation wasn't redesigned for the volume. The institutions getting real value used implementation as a chance to challenge the process itself.

Five questions to test whether your program scales.

Run these before your next headcount request or platform renewal. Where the answer is "no" or "not really," that's where design, not staffing, is the bottleneck.

The first three questions pressure-test your operating model.
The last two pressure-test whether your technology changed it.

Two ways to train. Built by practitioners, not academics.

Built by practitioners. NASBA-accredited CPE.