[MTE] [May 2026] [P1] Third-Party Risk, Resilience and Regulation: Building A Stronger Operational Framework

Part 1: Third-Party Risk Is Now an Operational Resilience Challenge

Introduction

“Third-Party Risk, Resilience and Regulation: Building a Stronger Operational Framework,” Anthony Lim shared a practitioner-led perspective on today's organisations that depend on an expanding ecosystem of vendors, cloud providers, outsourced partners, and digital platforms.  Discover why managing vendor relationships is no longer just procurement - it is now a critical operational resilience priority.

In today's digital and interconnected economy, organisations increasingly rely on third parties to deliver critical business services. Cloud providers, technology vendors, payment processors, outsourced operations, professional service firms, and subcontractors have become deeply embedded within modern operating models. Yet every external dependency introduces another point of potential failure.

Recent incidents involving cloud outages, cyber attacks, data breaches, supply chain disruptions, and technology failures highlight a critical lesson: every link matters. Third-party incidents no longer remain isolated events; they rapidly become enterprise-wide disruptions with operational, financial, regulatory, and reputational consequences.

Traditional vendor management approaches focused primarily on procurement and cost optimisation are no longer sufficient. Third-party risk has evolved into a strategic operational resilience issue.

Anthony Lim’s presentation introduced Third-Party Risk Management (TPRM) as an extension of broader enterprise risk management. Rather than a compliance exercise, TPRM should function as a dynamic and risk-based operating model built around four interconnected pillars:

1. Governance

2. Identification

3. Manage

4. Monitor

This framework mirrors the principles of operational resilience: identify dependencies, understand risks, continuously monitor exposures, and prepare for disruption.

Governance begins with leadership ownership. Organisations should establish clear risk appetite statements and determine how much risk they are willing to accept from third-party relationships. Risk appetite must align with business strategy because not all vendors are equally important. Critical suppliers supporting core business activities naturally warrant greater scrutiny and investment.

The presentation also reinforced accountability through the Three Lines of Defense model:

• First Line: Business ownership of vendor relationships and risk accountability
• Second Line: Risk and compliance oversight, frameworks, and governance
• Third Line: Internal audit providing independent assurance

A key challenge in many organisations is the misconception that technology teams own all technology-related risks. In reality, the business owner remains accountable because the business consumes the service and owns the outcome.

The second pillar—Identification—may be the most critical. Organisations often focus exclusively on outsourcing arrangements while overlooking non-outsourced but highly material dependencies.

Examples include:

• E-signature platforms storing sensitive documents
• Background screening providers handling personal information
• SaaS platforms hosting confidential corporate data
• Professional service firms holding privileged information

Third-party classification should therefore consider:

• Criticality to business operations
• Data sensitivity
• Regulatory impact
• Customer dependency
• Technology reliance
• Concentration exposure

A robust framework also requires organisations to classify vendors into risk tiers:

• Critical
• High
• Medium
• Low

This allows resources to focus on high-impact relationships instead of treating every vendor equally.

The message is clear:

Third-party risk management is no longer about managing suppliers.

It is about protecting critical business services and safeguarding operational resilience.

This is Part 1 of the two-part summary of Anthony Lim's presentation during BCM Institute's Meet-the-Expert webinar.  The webinar is summarised by Dr Goh Moh Heng, President of the BCM Institute.

Dr Goh Moh Heng, President of BCM Institute, summarises this webinar. If you have any questions, please speak to the author.

For Parts 1 & 2 ...

Click the icon below to continue reading parts of Anthony Lim's presentation. 

 

Third-Party Risk, Resilience and Regulation: Building a Stronger Operational Framework

More Information About Operational Resilience Courses

To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.

	If you have any questions, click to contact us.