David explains why the industry's decade-long obsession with "resilience" may be quietly limiting agility, why inventory buffering — once seen as a P&L sin — is back in fashion as a tariff hedge, and why 2020 was one of the most innovative years supply chain has ever had, simply because there was no other option. The conversation moves from the Ever Given's grounding in the Suez Canal (and the knock-on effects nobody was watching for) to the shift from static ERP snapshots to real-time, point-of-sale-driven planning, and on to the idea of agentic AI as a workforce in its own right — one that needs guardrails, not just guardrails around software.

Mike and David also dig into why these same principles apply well beyond physical goods — financial services, insurance, and any business built on supply and demand — and why hiring "industry insiders" can sometimes be the worst way to solve a problem.

Topics covered, in order:

• David's background — Coca-Cola, the Hong Kong airport build, Accenture and 23 years at Microsoft (Xbox, Nokia, Surface)
• How supply chain complexity has changed — from "simplify everything" to embracing volatility
• Why buffering inventory is back as a tariff hedge, after a decade of trying to kill it
• 2020 as one of supply chain's most innovative years — because there was no choice
• Why "resilience" can actually limit a supply chain's ability to grow and adapt
• Moving from "sense and respond" to "anticipate and act" using AI and predictive models
• The Ever Given, the Suez Canal, and the downstream bottlenecks nobody was watching for
• Multi-tier supply chain mapping vs understanding true industry-wide dependency risk
• Real-time point-of-sale data and the shift away from static, "point in time" ERP systems
• Federated inventory and dynamic order allocation
• Applying supply chain principles to financial services and other non-physical industries
• Agentic AI as a workforce, not just software — guardrails, accountability and trust
• Why hiring "industry insiders" isn't always the right call
• Common mistakes: sunk-cost thinking on legacy software, and "wait and see" paralysis on AI
• David's advice for building a resilient, nimble supply chain from scratch

Key quotes from David Warrick:

• "Never let a good crisis get in the way of innovation."
• "What we experience now is our new normal... it's a constant stream of grey swan events."
• "Supply chains are built to sense and respond, but the modern supply chain has to be able to anticipate and act."
• "Not every suggestion is a rip and replace."
• "This is not an if, it's a when conversation."

Guest: David Warrick, supply chain advisor and former Microsoft VP of Supply Chain (Europe, Middle East, Asia Pacific & Japan; original Xbox project manager; led Nokia integration and Surface manufacturing in China). Since retiring from Microsoft in 2022, he works with venture capital and private equity firms bringing startup technology into major corporate supply chains.

Third Party Therapy is a podcast about third-party risk, vendor management and supply chain resilience, produced in association with CeFPro. New episodes on Apple Podcasts, Spotify, Amazon Music, Audacy and YouTube.

🔔 Subscribe for more conversations on supply chain, AI and third-party risk management 🌐 Sign up to the newsletter: thirdpartytherapy.com

#SupplyChain #ThirdPartyRisk #TPRM #AgenticAI #ArtificialIntelligence #SupplyChainManagement #Microsoft #RiskManagement #VendorRisk #SupplyChainResilience

Laura spent almost 10 years in-house in public sector procurement before retraining as a coach and launching her practice in 2022. Donna has 25 years' experience supporting procurement and risk careers, including a background leading corporate governance recruitment, and set up her own coaching practice two years ago. Together they talk personal branding, burnout, imposter feelings and what actually helps a career move forward, whether you're aiming for CPO or planning your next step beyond it.

Topics covered:

📈 How procurement and third-party risk management have evolved as professions

⚖️ The "do more with less" pressure, and why comparing yourself to other organisations backfires

🧠 Confidence, overwhelm and decision paralysis — and why capability is rarely the real issue

🤝 Influencing without authority, company politics, and inheriting a predecessor's legacy

👀 Why procurement and TPRM go unnoticed when things run well, and the profession's "PR problem"

🔀 Whether procurement, supplier management and third-party risk are converging or splitting apart

🚪 How people actually enter procurement and TPRM careers

⚧ Diversity and gender balance in the profession — progress made and gaps remaining

✨ Why personal branding is now essential, not optional, for career progression

🧭 Life after CPO: portfolio careers, consultancy and avoiding burnout

🪜 Practical first steps for anyone feeling stuck at a career crossroads

Timestamps:

00:00 Intro

01:00 Donna and Laura's backgrounds and how Procurement Pivots started

05:30 How procurement and TPRM have evolved as professions

09:30 "Do more with less" and the comparison trap

12:00 Confidence, overwhelm and decision paralysis

16:00 Influencing without authority, politics and inherited legacy

20:30 Why the profession is invisible when it's working well

23:00 Converging or splitting: procurement, supplier management and TPRM

30:00 How people actually get into procurement and TPRM

34:30 Diversity and gender balance in the profession

39:00 Why personal branding is now essential

45:30 Life after CPO: portfolio careers and burnout

51:00 Advice for anyone at a career crossroads

54:30 Where to find Procurement Pivots

Procurement Pivots: procurementpivots.com/home

Subscribe to Third Party Therapy and join the mailing list at thirdpartytherapy.com.

#Procurement #ThirdPartyRisk #TPRM #CareerCoaching #ProcurementPivots #ThirdPartyTherapy #PersonalBranding #CareerDevelopment

Julie shares how her career as an IT auditor and healthcare security practitioner led her to co-found a roundtable that grew from 15 companies to 125 in four meetings — and eventually became TPRA. She and Mike discuss:

• How TPRM evolved from a procurement and compliance "check the box" function into a proactive, strategic risk management discipline
• Why finance and healthcare led on TPRM maturity, and how retail and manufacturing have caught up post-COVID (including the Target/HVAC vendor breach as a catalyst)
• The crossover between physical supply chain risk (manufacturing, pharma, automotive) and digital/cyber risk (SBOMs, AI-BOMs)
• How TPRM as a profession has evolved — from an accidental, side-of-desk role to a recognised career path, and the rise of Chief Risk Officer functions
• Geographic differences in TPRM maturity: the US and Europe (GDPR, DORA) leading, with Australia, Brazil, South Africa and China at earlier stages
• Fourth-party and supply chain discovery tools, including mentions of Interos, Black Kite and Prompt Armor
• TPRA's new AI-focused Trust Portal guidance, developed with a Third Party Advisory Committee of major tool providers, open for public comment until 3 July
• TPRA's upcoming events: a free virtual conference (9 September), quarterly tool "demo days," a new event for consultants (September), and in-person events in Dallas (14–15 October) and London (10–11 November) in partnership with CeFPro
• Julie's advice for anyone new to TPRM: download the free TPRM 101 Guidebook, learn your business, get involved in the community, and build cross-functional relationships early

Guest: Julie Gaiaschi, CEO & Co-Founder, Third Party Risk Association (TPRA) Host: Mike Day

Third Party Therapy is produced in association with CeFPro Connect.

🔗 Sign up to the mailing list at thirdpartytherapy.com 🔔 Subscribe for future episodes and hit like if you enjoyed this one

Chapter markers / timestamps

1. Introduction and welcome
2. Julie's background: IT audit → healthcare security → founding the TPRA roundtable
3. Why finance and healthcare led on TPRM, and how retail/manufacturing caught up post-COVID
4. Supply chain crossover: physical goods vs. services, SBOMs and AI-BOMs
5. The professionalisation of TPRM: from procurement side-of-desk to Chief Risk Officer functions
6. Where TPRM people come from, and the skills that matter most
7. Geographic differences: US, Europe, Australia, Brazil, South Africa, China
8. Technology landscape and fourth-party discovery tools (Interos, Black Kite, Prompt Armor)
9. AI, resourcing, and moving TPRM "up the value chain"
10. TPRA's Trust Portal guidance and Third Party Advisory Committee
11. Upcoming TPRA events (virtual conference, demo days, Dallas, London)
12. Lessons learned: advice for anyone new to TPRM
13. Close and sign-off

• TPRA website
• free TPRM 101 Guide
• TPRA virtual conference registration (9 September)
• London event with CeFPro (10–11 November)
• Dallas event with CeFPro (14–15 October)

Guest

Jeffrey Wheatman, Senior Vice President, Cyber Risk Strategist at Black Kite. Previously spent 15 years as a research analyst at Gartner, built a security programme at Martha Stewart Omnimedia, and ran his own consulting practice. Joined Black Kite four years ago.

In this episode

• [01:02] Jeffrey's route into cybersecurity — from managing a New York hardware store to Novell NetWare training, consulting, Martha Stewart Omnimedia, 15 years at Gartner, and now Black Kite.
• [04:42] How third-party risk management has evolved: from contract/legal sign-off, to security questionnaires, to outside-in vendor scores, to today's risk-based, intelligence-led approach.
• [07:11] Why not all vendors matter equally — tiering vendors so effort is focused on the ones that actually pose material risk.
• [09:45] Two UK-rooted supply chain incidents: the KNP Logistics ransomware attack that put the firm out of business, and the Jaguar Land Rover cyberattack that reportedly affected UK GDP.
• [11:17] Has the market moved beyond questionnaires? Financial services and insurance are further ahead; small niche vendors and giant vendors (e.g. Google) both present unique challenges.
• [13:47] The case for cyber risk quantification — Black Kite's OpenFAIR-based model and the three risk scenarios it prioritises: data loss, ransomware, and vendor non-delivery.
• [15:30] Translating cyber risk into business language: business impact analysis, stakeholder relationships, and a real anecdote about an aerospace manufacturer that stockpiled a critical component ahead of a supplier's ransomware attack.
• [23:04] Jeffrey's simplified framing for engaging executives: money coming in, money going out, and who's accountable if something goes wrong.
• [24:05] Scepticism around third-party risk scores, the case for methodology transparency ("open the raincoat"), and a credit-score analogy for contextualising vendor risk.
• [28:00] The shift from "assess everyone, monitor a few" to "monitor everyone, assess dynamically" — including examples from a large retail customer monitoring 100,000 vendors and an insurer streamlining onboarding.
• [30:00] Why questionnaires won't disappear entirely (audit and compliance still require them), and caution around AI-generated questionnaire responses and compliance reports.
• [33:08] Discovering AI in the supply chain — shadow AI, the idea of an "AI Bill of Materials," and why AI adoption often bypasses IT-led vendor review (e.g. HR or marketing tools).
• [40:01] A discussion of emerging agentic AI security research tools referenced in the episode, and concerns about a rising volume of reported vulnerabilities outpacing organisations' ability to triage them.
• [43:47] Attack chaining — how several medium-severity vulnerabilities can be combined for privilege escalation, changing how vulnerabilities should be prioritised.
• [46:47] A cautionary anecdote about a casino network reportedly compromised via an internet-connected aquarium thermostat.
• [47:54] Where CISOs should prioritise investment: governance and clear ownership, business impact analysis, a defined vendor onboarding process, and continuous monitoring — illustrated with the Change Healthcare/UnitedHealthcare ransomware case.
• [52:17] Regulatory pressure shaping third-party risk: DORA (EU/UK financial services), NIST, ISO, and HIPAA/NHS-equivalent requirements.
• [53:28] Closing thoughts on AI and human-in-the-loop working, including a quote Jeffrey attributes to Nvidia CEO Jensen Huang about AI and jobs.

Notable quotes

• "All vendors are equal. Some vendors are more equal than others." — Jeffrey Wheatman, paraphrasing Animal Farm
• "Your business executives care about three things: money coming in, money going out, and if something goes wrong, who's in trouble." — Jeffrey Wheatman
• "The biggest risk in communication is assuming it has taken place." — quoted by Jeffrey Wheatman, attributed to George Bernard Shaw
• "Don't ask your vendors if they're using AI. They are. It's a matter of understanding what they're using it for." — Jeffrey Wheatman

Mike sits down with Chloe Dellow, TPRM and GRC specialist at Diligent, who brings nearly eight years of experience helping organisations build, mature and optimise their third party risk programmes. Chloe offers a frank, experience-led perspective on why technology should enable a well-defined programme — not compensate for an absent one.

In this episode:

🔍 Why most organisations should sort their operating model before they even open an RFP ⚠️ The "magpie effect" — chasing features before understanding your own problem 🤖 How AI is entering TPRM in phases, from SOC 2 document review to continuous monitoring 🔨 Why the build vs buy debate is back — and the hidden risks of going DIY 🧩 Why AI risk isn't really "emerging", and what that reframing means for your framework ✈️ Which industries actually do supply chain visibility well (aerospace and automotive may surprise you) 🔄 The biggest mistake organisations make when switching platforms — and how to avoid rewriting history

Whether you're just starting out or looking to optimise a mature programme, this is a practical and honest conversation about what good looks like in TPRM today.

Timestamps 00:00 Introduction 02:15 Chloe's background — from JavaScript to TPRM advisory 06:30 How TPRM technology has evolved 11:00 Regulatory pressure and programme maturity 16:45 Helping clients through the "where do I start" problem 23:00 The magpie effect and the risk of over-configuration 29:30 AI adoption in TPRM — phased approaches and real use cases 38:00 Build vs buy — and the shadow AI risk 45:00 Is AI really an emerging risk? 51:30 Supply chain visibility — who gets it right? 58:00 What goes wrong in TPRM transformations 1:04:00 Where to start before you go to market

Guest: Chloe Dellow, Diligent Host: Mike Day

🔔 Subscribe for more episodes | 🌐 thirdpartytherapy.com | 📧 Sign up to the mailing list

#TPRM #ThirdPartyRisk #GRC #RiskManagement #AI #OperationalResilience #DORA #Compliance #Podcast

They cover the maturity landscape across financial services, pharma and manufacturing, the real-world AI use cases that are already delivering results, and the three most common mistakes organisations make when implementing TPRM technology. Whether you're just starting your TPRM journey or trying to evolve an existing programme, this episode is packed with practical insight.

Topics covered in this episode:

• How TPRM maturity differs across financial services, pharma and manufacturing — and why FS and pharma led the way
• The difference between a US "compliance-driven" approach and a more principles-based European one
• Why manufacturing actually has a head start on Nth-party visibility and ESG — and what FS can learn from it
• The cross-sector skills that are genuinely portable (anti-bribery/anti-corruption, cybersecurity) versus those that aren't
• The consolidation vs. diversification tension in TPRM technology ecosystems
• Where AI is delivering tangible results today — and why cyber/infosec assessment automation is the most mature use case
• Why getting AI approved internally is often the biggest blocker to adoption in regulated industries
• How shadow AI usage by employees is compressing organisations' due diligence timelines
• Dave's three biggest TPRM implementation pitfalls: overestimating maturity, overcomplicating scope, and over-relying on technology
• Why iterative, objectives-first implementation beats the traditional ERP-style "big bang" rollout
• How Aravo is building AI capabilities along two parallel tracks — for customers who are ready and those who aren't yet

Timestamps: 00:00 — Introduction 02:00 — Dave's background and 15 years at Aravo 04:30 — How TPRM maturity varies by sector and region 10:00 — Manufacturing vs. financial services: who's ahead and where 15:30 — Cross-sector lessons: what's portable, what isn't 20:00 — Technology trends: consolidation vs. proliferation 25:00 — AI in TPRM: hype vs. reality 31:00 — The biggest AI use case delivering results today 37:00 — Why internal AI approval processes are the real bottleneck 43:00 — AI as a "tool not a transformation" — Mike's take 47:00 — Aravo's AI development roadmap 53:00 — The three TPRM implementation mistakes to avoid 58:00 — Where to start: outcomes-first, iterative delivery

Professor Wilding shares his expert perspective on why the "Cost to Serve" must be applied to risk, how to segment vendors effectively, and why "Robustness" is no longer enough in a volatile global economy.

🕒 Timestamps:

• 00:00 – Introduction: Bringing the Academic Lens to TPRM.
• 03:45 – Richard’s journey: From Engineering and the "Brit Industry" to OBE.
• 14:20 – Why "Efficiency" is a dangerous goal for modern supply chains.
• 25:10 – Resilience vs. Robustness: What’s the difference?
• 38:45 – The Cost to Serve: Why you shouldn't treat every vendor the same.
• 52:30 – Advice for the next generation of supply chain leaders.

SEO Keywords: #SupplyChain #Logistics #Procurement #RichardWilding #RiskManagement #Resilience #Strategy #OBE

Clarence, a Stanford-trained engineer and cybersecurity veteran, shares his unique perspective on the "assessor fatigue" felt by both sides of the table. They dive deep into how AI can move beyond just making existing processes "faster horses" and instead fundamentally change how trust is established between organizations.

🕒 Timestamps

00:00 – Introduction: Is TPRM falling behind the market?

03:45 – Clarence’s Journey: From Stanford to Anti-Money Laundering (AML)

12:10 – The "Assessor’s Dilemma": Why busy work doesn't always equal risk reduction

21:30 – The Pace of Change: Why traditional assessments are static in a dynamic world

30:50 – AI & Coverbase: Moving from manual checklists to automated trust

38:15 – The "Faster Horse" Problem: Re-imagining the future of TPRM

47:40 – Elevating the Job: How automation allows risk managers to focus on strategy

55:30 – Closing thoughts: Mapping out the next 5 years of TPRM

💡 Key Takeaways

• The Problem with Static Assessments: Clarence explains why an annual review is often obsolete the moment it's finished and how the pace of software updates requires a new approach to monitoring.
• Assessor Fatigue: Insight into why critical vendors feel "put through the wringer" and how this friction actually hinders true risk transparency.
• AI as an Efficiency Engine: How Coverbase uses AI to bridge the gap, allowing for a more holistic and real-time understanding of vendor security postures.
• Rethinking the Function: Why the industry needs to stop asking for "faster horses" (doing the same manual tasks quicker) and start looking for the "automobile" (fundamentally changing the workflow).

🔗 Connect & Resources

• Official Website: thirdpartytherapy.com
• Guest Info: Learn more about Clarence Chio and Coverbase at Clarence Chio | LinkedIn

Search & SEO

Keywords: #TPRM #ThirdPartyRisk #ClarenceChio #Coverbase #Cybersecurity #AI #RiskAutomation #VendorManagement #SupplyChainSecurity #ThirdPartyTherapy #Innovation

The highlight of this episode is Mo’s deep dive into the practical use of Google Gemini (AI) to automate risk assessments, moving the dial from "policing" the business to "partnering" with it.

🕒 Timestamps

00:00 – Introduction: Managing risk at the speed of a digital bank

03:45 – Mo’s Background: Stumbling into TPRM via PwC

12:10 – The Integrated Operating Model: Merging Procurement, TPRM, and Resilience

20:30 – Speed to Market: Why "Check-the-Box" compliance doesn't work in FinTech

28:50 – AI in Action: Using Google Gemini to solve the "data mountain" problem

37:15 – Shifting the Culture: Moving from a "No" function to a "Business Enabler"

45:40 – Proactive Supplier Management: Having hard conversations about control gaps

53:00 – Closing thoughts and advice for the next generation of risk leaders

💡 Key Takeaways

• The "One-Stop-Shop" Model: Discover how Atom Bank integrates procurement and risk into a single lifecycle, ensuring risk is considered at the start of a project, not as a final hurdle.
• Leveraging Generative AI: Mo explains the specific prompts and processes used with Google Gemini to digest complex supplier documents, allowing a lean team to achieve massive scale.
• Bridging the Gap: Practical tips on how to align the conflicting goals of Procurement (speed/cost) and Risk (safety/compliance).
• Relationship-Driven Risk: Why the most effective TPRM tool isn't a piece of software, but the ability to build trust across the organization.

🔗 Connect & Resources

• Official Website: thirdpartytherapy.com
• Join the Community: Sign up for our mailing list to receive our "AI in TPRM" guide.
• Guest Info: Connect with Mo Randeree on LinkedIn to follow his work at Atom Bank.

Search & SEO

Keywords: #TPRM #ThirdPartyRisk #AtomBank #GoogleGemini #GenerativeAI #RiskManagement #ProcurementStrategy #FinTech #BusinessResilience #ThirdPartyTherapy #SupplyChainRisk

Episode overview

Season 2 opens with a practical deep dive into one of the hardest problems in modern third-party risk management: understanding what sits beyond your immediate suppliers. Mike is joined by Layla White, founder of TechPassport, to unpack why fourth- and fifth-party dependencies remain opaque, how early-stage suppliers change the risk profile, and why traditional questionnaires and web-scraping approaches struggle to keep up with today’s supply chains.

The conversation blends lived experience from financial services procurement and vendor management with a grounded look at how supply chain mapping actually works in the wild, where outages, cloud concentration, geopolitics, and cyber incidents collide.

What you’ll hear in this episode

• Why fourth- and fifth-party risk is still a blind spot for many organisations
• The limits of questionnaires and AI/web-scraped data for mapping supply chains
• How to identify critical dependencies deeper in the supply chain
• The problem of hidden concentration risk (especially with cloud and shared infrastructure)
• Why small suppliers and early-stage tech firms introduce different resilience risks
• The importance of validating supplier-provided data rather than guessing from public sources
• How outages propagate through unseen dependencies
• Why supply chain risk now stretches beyond cyber into resilience, data, ESG, and modern slavery
• Where regulation is pushing firms to understand and evidence extended dependencies

Key takeaways

• Supply chain risk is no longer a third-party problem. The real fragility often sits further down the chain.
• Public signals and scraped data are useful clues, not ground truth. Critical dependencies usually only emerge when suppliers confirm them directly.
• Concentration risk is rarely obvious until something breaks. Mapping dependencies before an incident is the difference between response and surprise.
• Early-stage suppliers need structure and support to meet enterprise expectations, not just scrutiny.
• Effective TPRM is a system of approaches, not a single tool. Questionnaires, live data, mapping, and supplier engagement all have different strengths.

Guest bio

Layla White is the founder of TechPassport, a platform focused on improving how organisations gather and manage supplier information, map extended supply chains, and engage early-stage technology providers. Layla previously worked in financial services procurement and vendor management, where she experienced first-hand the friction, delays, and blind spots that exist in traditional third-party onboarding and supply chain visibility.

Who this episode is for

• Third-Party Risk and Operational Resilience leaders
• Procurement and Vendor Management teams
• Cyber and Cloud risk practitioners
• Risk, Compliance, and Resilience professionals
• Anyone grappling with fourth-party visibility, concentration risk, or supplier onboarding in complex ecosystems

Listen to the episode

🎧 Full episode: https://thirdpartytherapy.com

Tags / themes

TPRM, Fourth-Party Risk, Supply Chain Mapping, Concentration Risk, Operational Resilience, Early-Stage Suppliers, Cloud Dependencies, Cyber Resilience

Read Charlie's article on Taking a business-critical approach to supplier nth-party IT risk management

Distributed in conjunction with CEFPRO Connect

AI Unleashed: Transforming Third-Party Risk

Guest: Natalie Druckmann, Head of EMEA at Certa

Host: Mike Day

Episode Summary

How is artificial intelligence reshaping third-party risk management? In this episode, Mike Day speaks with Natalie Druckmann from Certa, exploring how AI can transform due diligence, regulatory compliance, and supplier oversight. Natalie shares her journey from delivery and procurement into technology leadership, before unpacking the real-world use cases that are redefining TPRM—from automating document review to interpreting complex regulations like DORA. Together, they discuss how organisations can move from spreadsheet chaos to continuous monitoring, and from compliance overhead to strategic insight.

Key Topics

• Natalie's path from practitioner to tech leader
• The evolution of TPRM tech: from Excel → platforms → modular AI solutions
• Industry maturity: financial services vs pharma, retail, and defence
• Using AI to analyse supplier evidence, interpret new regulations, and enable 'risk management by exception'
• Why 'process → people → platform' is the right order for success
• Common pitfalls in adopting technology
• The future of TPRM: faster onboarding, smarter risk insight, and human + AI collaboration

Memorable Quotes

“We fixed the problem of not knowing—and created the problem of knowing too much.”

“AI in TPRM isn’t about replacing people; it’s about freeing them to focus where it matters.”

“Process first, people second, platform third.”

Takeaways

✅ Start with why and who, before deciding what or how.

✅ Design your process first—technology won’t fix a broken one.

✅ Use AI for transparency, not black-box decisions.

✅ Adopt a base-plate approach: start simple, build as you mature.

✅ Aim for risk management by exception, not exhaustion.

Links & Resources

🌐 thirdpartytherapy.com – show archive

🤖 certa.ai – learn more about Certa’s AI-driven risk solutions

💬 Connect with Mike Day on LinkedIn for future episodes

Distributed with support from CEFPRO Connect

Published in partnership with CEFPRO Connect

Episode Summary: What does your Third-Party Risk Management (TPRM) process look like from the other side of the table? In this episode of Third Party Therapy, Mike Day is joined by Ian Ellis, an innovation expert who has spent years working with Microsoft for Startups and various tech accelerators.

Ian shares the "bruising" reality of how emerging tech companies experience corporate due diligence. They discuss why a "one-size-fits-all" questionnaire can paralyze a 5-person dev team and how organizations can adapt their risk appetite to foster innovation without compromising security.

🕒 Timestamps

00:00 – Introduction: The challenge of assessing small, high-impact suppliers

04:20 – Ian’s Journey: From corporate innovation to the startup trenches

11:50 – The "Startup View": How a 100-question spreadsheet feels to a founder

19:15 – The Resource Gap: Why startups don't have "Compliance Departments"

27:40 – Litmus Test: Does your process actually measure risk or just persistence?

35:10 – Right-Sizing Risk: How to scale assessments for emerging tech

44:30 – The Human Element: Building respect and transparency into the onboarding flow

52:15 – Closing thoughts: Moving toward a more inclusive TPRM ecosystem

💡 Key Takeaways

• The "Bruising" Effect: Understand the operational impact that heavy-handed corporate processes have on small, agile companies.
• Proportionality is Key: Why asking a 5-person startup for the same evidence as a global conglomerate is a barrier to entry for innovation.
• Contextual Due Diligence: Learn how to look past the "missing" controls to understand the actual risk profile of a niche technology provider.
• The Reputation Risk: How your onboarding process defines your company's reputation in the tech community—are you a partner or a hurdle?

🔗 Connect & Resources

• Official Website: thirdpartytherapy.com
• Join the Community: Sign up for our mailing list to receive our guide on "Right-Sizing TPRM for Startups."
• Guest Info: Connect with Ian Ellis and learn more about his work with emerging tech EnterpriseTech.London: Posts | LinkedIn

Search & SEO

Keywords: #TPRM #Startups #EmergingTech #Innovation #RiskManagement #ThirdPartyRisk #Procurement #FinTech #BusinessAgility #ThirdPartyTherapy #Podcast

Episode Summary: The volume of data in Third-Party Risk Management has become unmanageable for manual teams. In this episode of Third Party Therapy, Mike Day sits down with Aki Eldar, founder of Mirato, to discuss how Artificial Intelligence is moving from a "future concept" to a practical tool. Aki explains how AI can automate the heavy lifting of evidence analysis—reading SOC2s and ISO certs for you—so that risk professionals can focus on making actual decisions rather than just processing paperwork.

🕒 Timestamps

00:00 – Introduction: AI as a risk vs. an opportunity

03:15 – Aki’s 30-year journey: From Cybersecurity & DLP to TPRM

11:40 – The "Mountain of Evidence" problem in modern risk management

19:25 – How AI actually "reads" and validates third-party documentation

27:50 – "Shadow AI": Managing the risks of unauthorized AI use in your business

36:10 – Why AI won't replace the human-in-the-loop

44:30 – The "MVP" Strategy: Why you should start standalone and scale later

52:15 – Closing thoughts and how to avoid the "Everest" trap

💡 Key Takeaways

• Automated Analysis: Move beyond simple data collection. Learn how AI can cross-check supplier questionnaires against their actual evidence (like SOC2 reports) to find gaps instantly.
• The Productivity Shift: By automating the "boring" work, AI allows risk managers to focus on the 20% of high-risk cases that actually require human expertise.
• Managing Shadow AI: Aki shares critical insights on how to handle employees using tools like ChatGPT and the data privacy risks that come with "dirty" AI models.
• Don't Climb Everest at Once: Why a "Minimum Viable Product" (MVP) approach is the most successful way to implement AI without disrupting your entire organization.

🔗 Connect & Resources

• Official Website: thirdpartytherapy.com
• Join the Community: Sign up for our mailing list for the latest in AI and TPRM.

Search & SEO

Keywords: #AI #ArtificialIntelligence #TPRM #ThirdPartyRisk #RiskAutomation #Mirato #CyberSecurity #RiskManagement #DigitalTransformation #ThirdPartyTherapy #SupplyChainRisk

🕒 Timestamps

00:00 – Intro: Why Modern Slavery is a TPRM priority

04:15 – Shayne’s story: From the food industry to the front lines

11:30 – The "Invisible" Victim: Defining modern slavery today

19:45 – Why your current audit process might be missing the truth

28:10 – The tiers of risk: Going deeper than your primary suppliers

36:50 – Practical advice for risk managers: Trusting your gut

45:20 – The human cost of the "race to the bottom" on price

52:00 – Final thoughts and where to start

💡 Key Takeaways

• Beyond Compliance: Moving from the "UK Modern Slavery Act" checklist to active, ethical risk management.
• The Audit Trap: Why pre-announced audits allow exploiters to coach victims and hide evidence.
• The Power of Curiosity: Why asking "How is this price possible?" is your best defence against slavery in your supply chain.
• Operational Reality: Understanding that exploitation often hides in the recruitment and labor agencies used by your suppliers.

🔗 Connect & Resources

• Official Website: thirdpartytherapy.com
• Join the Community: Sign up for our mailing list to receive episode deep-dives and TPRM resources.
• Guest Info: Connect with Shayne Tyler [Insert LinkedIn/Website Link].

Search & SEO

• Keywords: #ModernSlavery #TPRM #SupplyChainEthics #RiskManagement #HumanRights #ThirdPartyRisk #ESG #Sustainability #ThirdPartyTherapy

Paul Huggett: What Does Community Due Diligence Deliver?

In this debut episode of Third Party Therapy, host Mike Day sits down with Paul Huggett, Managing Director at Hellios and former TPRM lead at major financial institutions like Nationwide and Lloyds Banking Group.

Here is the optimized, "copy-paste" set of show notes for Episode 1: Paul Huggett, designed to perform across Spotify, Apple Podcasts, and YouTube.

Show Notes: Paul Huggett | What Does Community Due Diligence Deliver?

Episode Summary: TPRM has moved from a "check-the-box" exercise to a high-stakes regulatory requirement. In this debut episode of Third Party Therapy, Mike Day is joined by Paul Huggett, Managing Director at Hellios and former TPRM lead at Nationwide and Lloyds. Paul shares his journey from "poacher to gamekeeper" and explains how the Community Due Diligence model is solving the industry's biggest headache: the "many-to-many" web of repetitive supplier questionnaires.

🕒 Timestamps (Clickable on YouTube)

00:00 – Introduction: The evolution of TPRM since the 90s

05:20 – Paul’s Journey: From Practitioner to Managing Director

12:45 – The "Many-to-Many" Problem: Why the current model is broken

18:10 – What is Community Due Diligence? (The "Collect Once, Share Many" model)

26:30 – Big Banks vs. Small Firms: How different sized companies benefit

34:15 – Crisis Management: Using community data during the Russia-Ukraine conflict

42:50 – The Future of Tech: Why AI is the "new cloud"

51:10 – The Golden Rule: Why technology won't solve a data problem

55:30 – Closing thoughts and how to get started

💡 Key Takeaways

• The Efficiency Win: In a community model, suppliers provide data once to a central "pool," which is then accessed by dozens of buying firms, saving thousands of hours in administrative work.
• Speed of Response: Learn how community models allowed firms to map their entire supply chain exposure to global conflicts in minutes rather than weeks.
• Avoid the "Shiny System" Trap: Paul warns against buying expensive workflow tools before you have a solid data strategy—don't just buy a "shinier problem" to grapple with.
• ESG & Pooled Audits: The next frontier is moving beyond data collection into virtual site visits and shared environmental, social, and governance assessments.

🔗 Connect & Resources

• Official Website: thirdpartytherapy.com
• Join the Community: Sign up for our mailing list for TPRM deep-dives.
• Guest Info: Learn more about Helios and Paul Huggett at [Insert Link].

Search & SEO (Optimized for YouTube)

Keywords: #TPRM #ThirdPartyRiskManagement #CommunityDueDiligence #SupplyChainRisk #Helios #FSQS #RiskManagement #FinancialServices #ThirdPartyTherapy #RegulatoryCompliance

Why not visit www.thirdpartytherapy.com to sign up for more information