Don't Sacrfiice Speed for Security: Avoiding the TPRM Trap

After catching up on Natasha’s birthday sailing trip in Turkey and Conrad’s houseboat stay during the DPW conference in Amsterdam, the hosts dive straight into one of the most frustrating bottlenecks in modern business: Third-Party Risk Management (TPRM).  

Contracts and TPRM are the giant "boat anchors" slowing procurement down. But why does it have to be this way? Conrad, Natasha, and Zach break down why the current system is broken, the danger of treating risk as an administrative hurdle, and how to intentionally design a process that actually protects your enterprise.  

The Trap of "Risk Theater"

It is an open secret in the procurement world: almost nobody is doing TPRM right. Zach points out that the root cause is that organizations are not actually looking at the risk side of the equation; instead, they are focused purely on processing requests and documentation.  

Conrad estimates that a staggering 80 to 90% of businesses are merely participating in "risk theater." This means they are giving the illusion of risk visibility and awareness by checking compliance boxes, but they are not executing actual risk mitigation. Risk management teams are often driven by a fear of making a mistake, which leads them to cast an incredibly wide net and treat every supplier as a potential catastrophic threat.  

The Problem with Proportionality

The core failure of modern TPRM is a lack of proportionality. Zach highlights that organizations frequently fail to balance the probability of a risk against its actual impact.  

Because of this, the initial supplier triage phase becomes massively overcomplicated. Companies end up sending the exact same lengthy, generic risk questionnaires regarding financial viability and cybersecurity to almost all of their suppliers. This creates a system where an enterprise software vendor handling highly sensitive customer data is forced through the exact same administrative hurdles as a caterer showing up to a movie set for two weeks.  

When the Shoe Drops: SVB and CrowdStrike

The danger of relying on checkboxes instead of real data becomes painfully obvious during a global crisis. Natasha recalls the collapse of Silicon Valley Bank (SVB). While many procurement teams were crumbling because they had no way to estimate the impact on their supply chain, a well-prepared risk manager at her organization knew exactly which suppliers banked with SVB within five minutes.  

Conrad notes that the recent CrowdStrike failure exposed similar flaws. When systems went down globally, companies scrambled to determine which of their suppliers were impacted. Because many organizations suffer from fragmented ERP systems and poor master data, they lacked the ability to execute a rapid, many-to-many outreach to assess their actual operational risk.  

How to Fix TPRM: Intentional Design

To stop the delays and actually protect the business, procurement and risk leaders must step up and embrace intentional design. If you rely on accidental design, the process will naturally default to redundant questions, cross-functional delays, and wasted resources.  

Here is how the hosts suggest fixing the TPRM bottleneck:

• Segment by Criticality: Categorize your suppliers based on their specific risk levels and their direct impact on your revenue or operations.  
• Automate the Majority: Build an automated solution for the top 20% to 30% of your supplier base to handle standard compliance checks.  
• Go Deep on the Critical Few: Reserve your "white-glove," deep-touch risk management resources for the 1% to 2% of suppliers that represent a severe threat if something goes wrong.  

If you want your procurement cycles to run faster, you have to design them to be faster. Stop distracting your risk teams with the "trivial many," ditch the endless checklists, and start managing real risk.  

Transcript: Proc-N-Roll | Don't Sacrfiice Speed for Security: Avoiding the TPRM Trap

Conrad: Hello everybody, and welcome back to Proc and Roll, your guide to practical procurement. Today the three amigos are back together from the four corners of the world.  

Conrad: We talked in a previous episode about how contracts and TPRM together are the giant boat anchors dragging us down. Are people actually doing TPRM right today?  

Zach: TPRM is always one of the biggest pain points, and nobody's doing it right. The reason is nobody is looking at the risk side of it.  

Zach: The operation of going through supplier onboarding is very painful because risk teams aren't coordinated. Very often the risk isn't actually being managed at all; it's more being reported on and it's a lot of box-ticking.  

Natasha: Risk is unfortunately an afterthought. People just think the probability is low, so they have 55 other priorities like customers and revenue.  

Natasha: I worked at a company where the board identified ten red risks that had to be fixed, but the organization didn't give a budget for that. That kills the motivation of any risk management team.  

Zach: The way risk is done today with checking policies and submitting documents is not really risk management, that's risk documentation. Risk management is moving toward live systems and transaction monitoring.  

Conrad: The vast majority, like 80 or 90% of businesses out there, are participating in this risk theater, sort of pretending like they're managing risk. They're giving risk visibility and awareness, but they're not really doing risk mitigation.  

Natasha: You can easily categorize suppliers with a high level of risk depending on how much they impact your revenue. Assign a level of criticality and use software to verify their standing based on those criticalities.  

Zach: You have to look at proportionality. People are risk-averse and not thinking proportionally to what the risk actually is.  

Conrad: When you get into risk, you have to talk about probability and impact. For example, an HVAC supplier connected to a computer network presents a higher probability situation for a breach.  

Conrad: The amount of times companies send a reasonably generic risk questionnaire to all suppliers is very high. Almost everybody overcomplicates the triage up front.  

Natasha: Risk specifically should be way more segregated, separated, and pre-calculated where the shoe can drop. I wouldn't apply the rule of "the more the better." Be selective and go deep with a small selection.  

Natasha: I would create automated solutions for at least the top 20 to 30% of the supplier base, and do deep-touch management with 1 or 2% based on risk and criticality.  

Conrad: If you're going to claim risk under management, you have to get focused, or you're just doing risk theater. You need to be up to your elbows with suppliers that represent real risk, not distracted by the trivial many.  

Natasha: When a crisis hits, like the Silicon Valley Bank collapse, you want instant visibility to protect your enterprise. My risk manager knew within five minutes every single supplier who was banking there.  

Conrad: Or look at CrowdStrike. When a failure happens, you need a way to quickly reach out to your whole supplier base. That kind of collaboration needs to be many-to-many and very shareable to save time.  

Conrad: You're going to have to invest in leading it to work well. Intentional design is the answer, or risk is going to just continue doing what it's doing with big lengthy questionnaires and time delays.  

Conrad: If you want it to go better and faster, you've got to design it to work better and faster.  

Zach: Make sure you're managing the risk, not just reporting on it or ticking a box or meeting a regulatory obligation without understanding the underlying concerns. Use technology and invest the time in actually designing it properly.  

Conrad: Hey everybody, don't forget to like, comment, and share. We want these episodes available to as many of our procurement buddies as possible.  

This transcript has been edited for clarity while maintaining all substantive content