Fresh insights, the 3rdRisk blog

The introduction of the European NIS2 Directive presents businesses with a significant challenge in strengthening their digital resilience. In the fourth episode of 3rdRisk’s RiskTalk podcast, three experts discuss the impact and practical implications of NIS2: Jasper Nagetaal (RDI), Willem van der Valk (Eraneos) and our own Bram Ketting.

In the latest episode of Risk Talk, the podcast by 3rdRisk, the spotlight is on the role of artificial intelligence (AI) in third-party risk management (TPRM). Experts Harm Kuiper (Deloitte), Lars Wiegers, and Bram Ketting (3rdRisk) share their insights on how AI supports risk professionals in managing risks, the tangible benefits it offers, and the challenges it presents.

The EU’s Corporate Sustainability Reporting Directive (CSRD) requires large companies and some non-EU businesses to report their ESG performance every year. It builds on an earlier directive, expanding the rules to more companies. This blog explains what the CSRD is, why it matters, and how businesses can prepare for it.

In the first episode of our new podcast RiskTalk, the Digital Operational Resilience Act (DORA) is discussed. DORA is a European regulation designed to enhance the digital resilience of the financial sector by requiring companies to manage IT risks carefully. Want to learn more about how to prepare your organisation for DORA? Listen to the full episode of the RiskTalk podcast and discover how to integrate digital resilience into the core of your business strategy.

Procurement is essential for managing third-party risks, preventing financial losses, fines, and reputational damage. Procurement teams assess and reduce risks, ensure compliance, and adapt to regulations like the German Supply Chain Act and GDPR. Through due diligence, monitoring, and technology, procurement strengthens supplier relationships and enhances resilience.

This blog post aims to provide a comprehensive understanding of DORA, its key requirements, and how financial entities can master compliance. We will delve into the specifics of the regulation, its implications for financial entities, and explore solutions that can simplify the path to compliance.

The Digital Operational Resilience Act (DORA) and its Draft Regulatory Technical Standards (RTS) provide a comprehensive framework for managing ICT third-party risks in the financial sector. In this blog post, we take a closer look at the requirements included in the RTS.

This is the fifth in a six-part blog series on getting started with third-party risk management. In this blog post, we will continue our implementation with the foundation of third-party risk management: due diligence assessments such as self.-assessments, audits and external data on your third-party risk posture.

In this blog post, we take a closer look at the EU Deforestation regulation. This regulation, effective in 2024, aims to prevent deforestation and forest degradation by regulating the import and export of commodities like palm oil, soy, cattle, coffee, and timber within the EU market.

This is the fourth in a six-part blog series on getting started with third-party risk management. In this new blog post, we will discuss the importance and implementation of a segmentation strategy. This segmentation will inform the extent to which and how you should perform due diligence on your third-party relations.

The German Supply Chain Act (LkSG), effective since 1st January 2023, enforces strict due diligence obligations on companies to address human rights and environmental risks within their supply chains. Businesses must implement measures such as risk management systems, regular risk analyses, preventive actions, complaints mechanisms, and annual reporting.

This is the third in a six-part blog series on getting started with third-party risk management. In this blog post, we will discuss the third-party- and contract catalogue. An essential element in TPRM and a prerequisite for gaining control over your third-party relations.

This is the second in a six-part blog series on getting started with third-party risk management. In this blog post, we will discuss the internal & external requirements that you have to take in consideration for your TPRM efforts. It is essential to start with identifying the relevant requirements as these will be the input for the next steps.

This is the first in a six-part blog series on getting started with third-party risk management. We will first start with a definition of third-parties, a short summary of reasons why organisations are ramping up their TPRM capabilities (and why you should also do that), after that we will explore the key elements of any TPRM capability program.