Fresh insights, the 3rdRisk blog

In this episode of RiskTalk, we delve into the importance and necessity of monitoring third parties. What exactly is it, why is it so crucial, and what should you pay attention to? Our guests are Peter van den Toorn, CEO of Business Radar, and Sem de Spa, Director at Deloitte specialising in sustainability technology.

3rdRisk is proud to announce its official partnership with Deloitte in the USA. In response to the growing demand for user-centred third-party risk management technology in the USA, this collaboration aims to help enterprises tackle risks arising from third-party collaborations, supply chain complexity, and regulatory compliance.

3rdRisk is proud to be featured in the latest Market and Buyer’s Guide for Third-Party Risk Management as a notable provider of third-party risk management technology.

In this episode of RiskTalk, Berry Kok (Manager Risk & Internal Audit at HEMA), Anouk Jessurun (founder of Winitstreet, specialising in risk training), and our Bram Ketting share practical insights on the role of employees in risk management. They discuss how, with the right tools and engagement, employees can actively contribute to identifying and mitigating risks within the third-party chain.

Third-party security questionnaires are vital for managing vendor risks, but common pitfalls can undermine their effectiveness. To optimise results, CISOs should: simplify questionnaires for better responses, tailor them to vendor risk levels, adopt a centralised assessment approach, align with industry frameworks like ISO 27001, and clearly explain the importance of the process to vendors.

The introduction of the European NIS2 Directive presents businesses with a significant challenge in strengthening their digital resilience. In the fourth episode of 3rdRisk’s RiskTalk podcast, three experts discuss the impact and practical implications of NIS2: Jasper Nagetaal (RDI), Willem van der Valk (Eraneos) and our own Bram Ketting.

We are proud to announce that 3rdRisk has been recognised in Verdantix's "Smart Innovators: Reputational Risk Software 2024" report, published in November 2024. This acknowledgment underscores our commitment to advancing risk management and compliance for organisations managing third-party relationships, especially when navigating the complexities of contractors, governance, and reputational risks.

In the latest episode of Risk Talk, the podcast by 3rdRisk, the spotlight is on the role of artificial intelligence (AI) in third-party risk management (TPRM). Experts Harm Kuiper (Deloitte), Lars Wiegers, and Bram Ketting (3rdRisk) share their insights on how AI supports risk professionals in managing risks, the tangible benefits it offers, and the challenges it presents.

The EU’s Corporate Sustainability Reporting Directive (CSRD) requires large companies and some non-EU businesses to report their ESG performance every year. It builds on an earlier directive, expanding the rules to more companies. This blog explains what the CSRD is, why it matters, and how businesses can prepare for it.

In the first episode of our new podcast RiskTalk, the Digital Operational Resilience Act (DORA) is discussed. DORA is a European regulation designed to enhance the digital resilience of the financial sector by requiring companies to manage IT risks carefully. Want to learn more about how to prepare your organisation for DORA? Listen to the full episode of the RiskTalk podcast and discover how to integrate digital resilience into the core of your business strategy.

Procurement is essential for managing third-party risks, preventing financial losses, fines, and reputational damage. Procurement teams assess and reduce risks, ensure compliance, and adapt to regulations like the German Supply Chain Act and GDPR. Through due diligence, monitoring, and technology, procurement strengthens supplier relationships and enhances resilience.

This blog post aims to provide a comprehensive understanding of DORA, its key requirements, and how financial entities can master compliance. We will delve into the specifics of the regulation, its implications for financial entities, and explore solutions that can simplify the path to compliance.

The Digital Operational Resilience Act (DORA) and its Draft Regulatory Technical Standards (RTS) provide a comprehensive framework for managing ICT third-party risks in the financial sector. In this blog post, we take a closer look at the requirements included in the RTS.

This is the fifth in a six-part blog series on getting started with third-party risk management. In this blog post, we will continue our implementation with the foundation of third-party risk management: due diligence assessments such as self.-assessments, audits and external data on your third-party risk posture.

In this blog post, we take a closer look at the EU Deforestation regulation. This regulation, effective in 2024, aims to prevent deforestation and forest degradation by regulating the import and export of commodities like palm oil, soy, cattle, coffee, and timber within the EU market.

This is the fourth in a six-part blog series on getting started with third-party risk management. In this new blog post, we will discuss the importance and implementation of a segmentation strategy. This segmentation will inform the extent to which and how you should perform due diligence on your third-party relations.

The German Supply Chain Act (LkSG), effective since 1st January 2023, enforces strict due diligence obligations on companies to address human rights and environmental risks within their supply chains. Businesses must implement measures such as risk management systems, regular risk analyses, preventive actions, complaints mechanisms, and annual reporting.

This is the third in a six-part blog series on getting started with third-party risk management. In this blog post, we will discuss the third-party- and contract catalogue. An essential element in TPRM and a prerequisite for gaining control over your third-party relations.

This is the second in a six-part blog series on getting started with third-party risk management. In this blog post, we will discuss the internal & external requirements that you have to take in consideration for your TPRM efforts. It is essential to start with identifying the relevant requirements as these will be the input for the next steps.

This is the first in a six-part blog series on getting started with third-party risk management. We will first start with a definition of third-parties, a short summary of reasons why organisations are ramping up their TPRM capabilities (and why you should also do that), after that we will explore the key elements of any TPRM capability program.