---

Third-party risk doesn’t stand still, and neither should your TPRM program.

Regular updates are the only way to keep it strong, but where should you focus?

One way to decide is by keeping an eye on emerging trends. This will tell you whether your program is aligned with the current risk landscape and if it keeps pace with peers.

That’s why, in this article, we’ll cover five of the most important TPRM trends to consider.

Let’s dive in!

Rise of Predictive Analytics

Advanced AI and machine learning are being increasingly used in TPRM for many different purposes.

One that particularly stands out, though, is predictive analytics.

In fact, PwC’s Global Compliance Survey 2025 shows that 46% of organizations are already piloting or using AI for this use case, while only 22% have no plans to do so.

Illustration: Veridion / Data: PwC

So, we can expect the majority of companies to join this trend soon.

However, we should note that AuditBoard’s report shows that, currently, high-maturity organizations are much better at using the technology for daily governance, risk, and compliance (GRC) operations.

This is especially true for risk tracking and predictive risk modeling, the two most common GRC use cases across mature organizations.

Illustration: Veridion / Data: AuditBoard

Predictive risk modeling, powered by predictive analytics, helps organizations anticipate issues before they materialize and mitigate them proactively.

This is possible because, unlike legacy technologies that relied on manual checks and rigid logic, AI and machine learning enable dynamic, adaptive capabilities.

Among them are advanced functions, such as:

• Anomaly detection
• Real-time analysis of vendor data
• Flagging inconsistencies across documentation

Let’s take Safe, an AI-powered cyber risk management company, as an example.

Their agentic AI can use historical vendor data to predict future risk.

More specifically, the AI looks at past vendor incident data to uncover hidden patterns and threats before they escalate.

Source: Safe

This approach yields an unprecedented level of foresight, largely thanks to AI’s ability to learn from data, improve over time, and apply newly-acquired insights to never-before-seen data.

However, one crucial prerequisite for this is having accurate and up-to-date information. Without it, not even the most advanced AI systems can make correct predictions.

The problem is that many TPRM platforms don’t collect data themselves, or simply don’t provide the level of accuracy and freshness needed.

You can overcome this challenge by integrating a third-party data provider.

One that stands out is Veridion, which specializes in equipping procurement teams and external systems with real-time supplier intelligence data.

Source: Veridion

Veridion collects and validates data from a wide range of reliable sources, including news outlets, available reports, and company websites, to provide verified vendor information.

Its current database spans over 134 million companies across the globe.

The data it delivers on every company helps organizations identify different types of vendor risk, from FOCI and operating issues to product and financial health.

Source: Veridion

You can use this structured data to build analytical and predictive risk models, forecast vendor performance, and identify patterns and anomalies that may indicate threats.

That way, you’ll shift your TPRM program from reactive to proactive risk management.

This is critical because, as we’ll see below, you’re now likely facing a broader and more complex range of risks than ever before.

Growing Scope of Risk

Kapish Vanvaria, EY Global Risk Consulting Leader, says that third-party relationships have never been more complex and more numerous.

More specifically, he says that the average company now manages more third-party relationships than at any point in the past.

On top of that, the complexity of these relationships has increased, too.

Illustration: Veridion / Quote: EY

This is largely because many activities once performed within a company’s own environment are now handled by third parties.

As a result, companies have less control and oversight over, in many cases, their most critical operations.

This leads to companies being exposed to a far greater number and wider range of third-party risks.

In fact, according to Prevalent’s 2024 TPRM study, organizations are now tracking as many as eight broad risk domains in their vendor portfolios:

• ESG risks
• Financial risks
• Compliance risks
• Data privacy risks
• Reputational risks
• Cybersecurity risks
• Operational resilience risks
• Software supply chain security risks

The report also revealed that the breadth and diversity of these risk domains force several departments to jointly manage vendor risk.

This often makes the task even more challenging, as each department typically has a unique objective that may or may not align with those of other departments.

For instance, information security teams are primarily focused on mitigating cybersecurity risks, while procurement tends to focus on streamlining vendor and supplier onboarding.

Illustration: Veridion / Data: Mitratech

So, a more complex risk landscape leads to more complex risk management.

However, the solution isn’t to exclude certain departments from the process.

Quite the opposite:

Different in-house functions must coordinate and collaborate, but that collaboration needs to be streamlined.

If they continue operating in isolated bubbles or pursuing different goals, critical risks will slip through the cracks.

Gartner’s research confirms that cross-functional collaboration is the key to timely risk mitigation.

Illustration: Veridion / Data: Gartner

This is especially true when it comes to sharing TPRM information and ensuring that all stakeholders understand it fully.

This allows TPRM teams to develop a much-needed holistic view that captures all relevant risk domains.

Such an approach will also ensure effective prioritization, even as the vendor roster grows.

Stricter Regulatory Requirements

Another trend we see is that third-party risk regulations are becoming stricter and more widespread globally.

For example, IAPP’s January 2025 report revealed that as many as 144 countries worldwide now have some form of national data privacy laws.

Illustration: Veridion / Data: IAPP

Compared to IAPP’s March 2024 report, the number of countries enacting these laws has grown by seven in a span of just a few months.

So, it’s likely that many more will follow soon.

But what does this have to do with TPRM, you ask?

Well, a lot.

Many privacy laws now hold organizations accountable not only for how they manage customer data, but for how their third parties handle it as well.

For instance, Vanta, an AI trust management platform, explains that the GDPR requires organizations to ensure that third parties adequately protect the shared data.

In other words, you are responsible for how your external entities handle the personal data of EU citizens and businesses, as well as those located in the EU/EEA, if you’ve shared it with them.

Source: Vanta

Of course, the GDPR is only one of the more well-known data privacy laws.

Depending on where your company operates, its industry, and other criteria, it may be required to honor a number of similar laws and regulations.

Emily Hancock, CPO at Cloudflare, a global cloud services provider, mentions three other regulations that have been enacted since 2023 and are affecting many U.S. businesses:

• The Digital Operational Resilience Act (DORA)
• The Network and Information Security 2 (NIS2) directive
• The U.S. Securities and Exchange Commission (SEC) Cybersecurity Rule

Hancock further warns that, given the complexity of these regulations, it isn’t realistic to expect a single solution to cover all of them.

Instead, organizations need to approach compliance holistically.

Illustration: Veridion / Quote: TechRadar

Some measures to implement include standardized, auditable reporting and vendor management processes.

More specifically, companies should integrate strong onboarding, continuous assessment, and documentation.

In practice, this means that:

• Due diligence should be done upfront
• Vendors should be monitored regularly
• Every step, including onboarding checks and monitoring activities, should be logged in a structured, auditable trail

These best practices ensure companies are prepared for audits and can prove compliance.

Growing Importance of ESG

ESG considerations, like carbon emissions, ethical practices, and labor standards, are becoming the center of vendor evaluations.

This is largely due to a combination of investor, customer, and regulatory demand.

In PwC’s 2021 survey, 80% of consumers said they are more likely to buy from companies committed to Environmental and Governance issues.

An additional 76% also said they are more likely to buy from companies that stand for Social impact.

Illustration: Veridion / Data: PwC

Global investor survey, another PwC survey from the same year, showed that investors are just as concerned with ESG as consumers.

Over three-quarters said they are considering a company’s ESG risk and opportunity management when making investment decisions.

Illustration: Veridion / Data: PwC

This makes strong ESG performance a prerequisite for winning investor confidence.

ESG-related regulatory demands are increasing, too.

Research from the ESG Book indicates that the number of global ESG regulations has increased by 155% since 2011, with 1,255 new ESG policy interventions introduced over that period.

However, experts say that organizations should not treat ESG as another box to check to satisfy investors, consumers, or regulators.

They argue that ESG compliance has real, tangible benefits that companies need to recognize.

Laura Kelly, a PwC director in ESG reporting and assurance, highlights that following ESG best practices can significantly enhance organizational decision-making.

Illustration: Veridion / Quote: Financial Times

For instance, ESG frameworks can surface supplier risks, like labor violations and weak compliance practices, earlier in the process.

This further helps procurement choose better-suited suppliers from the get-go, create training programs dedicated to mitigating identified issues, and consequently reduce reputational and regulatory exposure.

That’s why contemporary TPRM programs now include evaluating vendors’ sustainability credentials.

As S&P Global clarifies, this involves evaluating vendors across all three ESG dimensions.

Here are some examples of what should be assessed under each:

• E: suppliers’ environmental impact, carbon emissions, and tracking against net-zero goals
• S: suppliers’ human rights and labor practices
• G: suppliers’ ability to prevent IT system failures and major cybersecurity incidents

Of course, these are just a few examples.

The strongest TPRM programs will assess a much more comprehensive list of risks.

We can expect more companies to start strategically tackling them in the coming period.

This may include adopting more formal assessment frameworks, integrating ESG data into vendor evaluations, and regularly reporting ESG performance to stakeholders.

Shift to Continuous Automated Monitoring

We saw that both the public and regulators strongly expect companies to adequately manage a rising number of third-party risks.

If they want to meet these demands, organizations can no longer rely on manual, periodic vendor assessments.

As Dov Goldman, VP of Risk Strategy at Panorays, says, occasional or one-off assessments are simply inadequate in a fast-changing risk environment.

Illustration: Veridion / Quote: Panorays

Goldman also highlights that continuous monitoring is key to mitigating risks and maintaining compliance in today’s landscape.

This is exactly the trend we currently see in TPRM, further propelled by automation, AI, and machine learning.

In practice, continuous, automated monitoring involves constant scanning for risk indicators.

This can include scanning for a vendor’s:

• Legal disputes
• News mentions
• Financial filings
• Cybersecurity ratings
• Any other signals that could indicate risk

Besides just tracking risk indicators, automated monitoring systems flag significant changes and alert organizations of increased or simply altered risk levels.

Human experts can then review these changes and decide whether to take action.

This approach is, according to LexisNexis, very much welcomed and encouraged by regulators.

In fact, authorities expect companies to not only capture current but also future risks, which is nearly impossible without automated monitoring.

Source: LexisNexis

In this case, however, technologies like AI and machine learning aren’t necessarily used for prediction, but rather for operational automation and faster detection.

The main purpose of automated risk monitoring is to simply reduce blind spots and enable faster detection of relevant changes.

This, in turn, enables more agile risk management and ensures organizations can respond proactively to emerging issues.

It can even create a competitive advantage, especially considering rising expectations around corporate accountability.

Hard to see the downside, isn’t it?

Conclusion

We’ve explored five of the most crucial TPRM trends to know about, from AI-powered predictive analytics to automated monitoring.

The key takeaway is clear: your program can’t stand still.

To stay resilient, compliant, and competitive, it must stay aligned with these emerging practices.

If your current approach doesn’t measure up, now is the moment to act.

Start making adjustments today, and turn your TPRM program into a strategic advantage.