Third-Party Risk Management (TPRM)

This session is designed for procurement, vendor management, risk, compliance, legal and IT professionals working in the financial sector. It provides a high-level overview of the third-party risk management lifecycle, from the initial identification of a business need through to contract termination and record archiving, considering both the buyer's and the vendor's perspectives.

Participants will explore a structured framework built around four key phases: Governance, Pre-Award, Award and Post-Award. The session highlights the principal activities, controls and regulatory considerations associated with each stage of the lifecycle, while providing an overview of the relevant European regulatory frameworks currently in force.

Participants will leave the session with:

• A clear overview of the third-party risk management lifecycle and how its phases and stages connect.

• An understanding of the respective roles of buyers and vendors, and of the activities they carry out jointly.

• Awareness of the main regulatory requirements that apply to third-party arrangements.

• A reference framework to position their own practices and identify areas for further development.

• Introduction to the third-party risk management lifecycle

• • Overview of the framework: phases, stages, milestones and activity blocks.

  • Regulatory landscape: DORA, EBA Guidelines, GDPR, NIS 2 (...).

• Phase 0 – Governance

• • Governing the vendor lifecycle (buyer side) and customer delivery (vendor side).

  • Roles, responsibilities, workflows and activities dependencies.

• Phase 1 – Pre-award

• • Solicitation development: needs assessment, market research and the call for tenders.

  • Proposal development: assessing the request, the bid decision and proposal submission.

• Phase 2 – Award

• • Contract scoping: clause review, remediation, negotiation and approval.

  • Service scoping: classification, due diligence, risk assessment, exit strategy and vendor selection.

• Phase 3 – Post-award

• • Service delivery: contract administration, service monitoring and change management.

  • Service termination: preparing and executing termination, and formal closure.

• Closing session

• • Key takeaways and Q&A.

This session is designed for professionals in the financial sector who are involved in, or are new to, the management of third-party relationships and outsourcing arrangements, including:

• Procurement and Vendor Managers

• Outsourcing Officers and Managers

• Compliance Officers and Managers

• Risk Officers and Managers

• Legal Officers and Managers

• Contract Managers

• IT professionals, Information Security professionals (including CISOs) and Data Protection professionals (including DPOs)

• Internal Auditors

• Project Managers

• Students and early-career professionals seeking an introduction to third-party risk management

This programme is suitable for both operational and managerial profiles who need to understand the third-party risk management lifecycle and the associated regulatory requirements within the financial sector.