The Most Common TPRM Question Isn't About AI

In October we spoke with 21 third-party risk teams: banks, insurers, manufacturers, software companies, and a few people running TPRM as a team of one. We wrote down every question they asked. The most common one was not about AI. Nine of the 21 asked some version of the same thing: does it connect to the systems we already use?

It sounds like a feature request. It isn't. It's a description of how the job works: vendors arrive through other teams' systems, and the results need to end up back in them.

TPRM doesn't own the front door

Very few vendor relationships start in the risk team. They start in procurement, in a contract request, in an engineering ticket, or with someone in marketing putting a credit card into a new SaaS tool. By the time third-party risk hears about it, the vendor has been chosen, the business owner is waiting, and the contract is half negotiated.

So the risk team's first problem is not assessing the vendor. It is finding out the vendor exists. Almost every integration question we heard was a version of that. Can intake come from our procurement system? Can a new request open a ticket on our board? Can our identity provider show us apps that are already running and not in the inventory?

That last one deserves attention. Several teams asked about shadow IT: apps people sign into with company credentials that nobody ever reviewed. The identity provider already knows about them. The vendor inventory doesn't. The gap between those two lists is a more honest measure of program coverage than any metric on a dashboard.

The output has to land somewhere else too

The other half is where results go. A finished assessment is invisible to everyone outside the risk team until it shows up where they already work: a ticket that tells the next team to proceed, an issue in the enterprise risk system, an approval recorded somewhere an examiner can find it.

Better questions than "do you integrate?"

Every vendor says yes to that one in a demo. Ask about the handoffs instead:

• Where does a new vendor request start today, and can the risk process start there?
• Who needs to see a finished assessment, and where do they already work?
• Which list is more complete: your vendor inventory or your identity provider?

The hard part of TPRM was never the questionnaire. It was everything around it.