by Nikolay Filipets A few weeks ago I was reviewing a vendor's annual reassessment and noticed their responses had gone from "a person types back" to "instant, weirdly good answers." Nothing in our questionnaire asked about it. Nothing in their SOC 2 flagged it either. The vendor hadn't done anything wrong - our intake process just never had a box for it. That's the situation a lot of us are in right now. Most of our third parties are, in some form, AI companies these days, w

It is scary how security breaches have become a normal part of our lives. Recently my mortgage provider disclosed a breach that was...

by Nikolay Filipets Whenever I read about TPRM best practices or attend a webinar about Third-Party Risk Management, I always hear tons...

Organizations should apply very conservative thinking before considering outsourcing TPRM function(s) to an external entity.

by Nikolay Filipets Recently I came across a conversation about the longevity of TPRM risk assessment results. In other words, when does...

by Nikolay Filipets In this article I would like to cover basic TPRM Policy components. While there are multiple ways to go around...

by Nikolay Filipets The paradigm of People, Process and Technology became a standard in nowadays organizational development. Let’s...

What is the first thing you will do when the pandemic is over? We keep saying that the world will be different, that the economy will...

My first professional role in corporate America happened to be in Sourcing and Procurement, where I observed a lot of software and...

A well-executed approach to third party risk management (TPRM) can drive competitive advantage and cultural change. However, one of the...