Third-party risk in the era of the cloud and artificial intelligence

Why third-party risk grows with the cloud and artificial intelligence, what its challenges are and how to report it to senior management.

Interview summary

Enrique Gómez Lobera, Global Head of Third-Party Risk at the BBVA Group, explains that this risk arises when functions, processes or data that matter to the institution or its clients are placed in the hands of suppliers or other third parties. If it materializes it can mean poor customer experiences, process disruption, financial losses or reputational damage. He notes that concern in the sector is high and growing, and that digital transformation, platforms, ecosystems and artificial intelligence amplify it: just as the cloud concentrated critical processes and data in large technology providers, he expects the same to happen with artificial intelligence.

Unlike financial risk, which is measured in economic terms with widely used methods, third-party risk is less developed and harder to monitor. Among the main challenges he lists knowing the third-party base, coordinating the teams involved in managing it and monitoring, together with complex subcontracting chains and the risk of excessive dependence. To inform senior management and the board he proposes starting with simple reports and advancing as the program matures: how many suppliers there are, how many are critical, how many have passed all controls, how many have pending plans and how many have not been managed or monitored on time.

Topics covered

• What third-party risk is and when it arises
• A growing concern in the financial system
• The effect of the cloud and artificial intelligence on this risk
• Challenges: knowing the third-party base, coordinating teams and monitoring
• Chained subcontracting and excessive dependence
• Indicators and reports for senior management, according to program maturity