Third-party risk: toward preventive and strategic management aligned with business continuity

What it is about

Carlos Suárez Fernández, of Management Solutions, explained at the Third Annual Risk Conference (September 2025) how to evolve third-party risk management from a reactive approach to a preventive and strategic one, aligned with business continuity.

The 20-slide presentation is organized into four blocks: the challenges of third-party risk management (regulatory environment, impact on continuity and maturity), a management framework (risk domains, supplier life cycle and coordination across the three lines of defense), the keys to evolving toward more anticipatory management and the conclusions.

Objectives

• Identify the challenges organizations face when managing critical suppliers.
• Present a comprehensive framework covering all risk types and the entire supplier life cycle.
• Propose keys for more strategic management: supplier map, risk appetite, risk-based management, exit plans and data.

Key takeaways

1. Third-party risk management is a central component of business continuity, because of its impact on critical processes and the difficulty of activating reversal or replacement plans.
2. The framework must be cross-cutting across risk types and cover the supplier's full cycle: decision and planning, vetting, negotiation and contracting, service monitoring and termination.
3. Analyzing the supplier map makes it possible to identify strategic suppliers and manage concentration risks and those of high dependence or single point of failure.
4. Management must be differentiated according to the criticality of the service, with reinforced monitoring and exit plans that identify alternative suppliers.
5. The proposed transformation moves from passive, reactive and unsegmented management to strategic, integrated and proactive management of critical suppliers.