Third-party risk management (TPRM) processes designed for a few dozen vendors rarely decline gracefully as portfolios grow. According to a new eBook from RegTech firm Copla, they fail at a predictable point, and the culprit is not review effort but coordination.
Every vendor still needs sign-off from the same four functions: compliance, legal, IT and a business owner. Doubling a portfolio from 30 to 60 vendors does not change that requirement. It does change how often four busy calendars must align. Hiring another analyst adds review capacity, but it does nothing for calendar availability, which is the resource that runs out first.
The pressure is compounded by regulatory complexity. The World Economic Forum’s Global Cybersecurity Outlook 2025 found that 69% of organisations consider cyber regulations too complex or numerous to track, or cannot verify whether suppliers comply.
The guide argues that automation decisions should be made answer by answer, not vendor by vendor. Tasks that are fixed, routine and verifiable, such as document chasing, questionnaire distribution, risk scoring, approval routing and certification expiry tracking, can be automated.
Judgement calls, including whether an answer is acceptable, whether to grant an exception or how to explain a change to a regulator, should remain with a named person. Copla estimates roughly 80% of a TPRM workflow falls into the automatable category.
Generic questionnaires are another bottleneck. Treating a payroll provider with access to salary data the same as a courier with access to a loading dock wastes reviewer time. In one example cited, a 45-vendor portfolio using a single questionnaire took eight to ten weeks to clear approvals. Introducing three tiers based on data access and criticality cut that time by more than half.
Timing matters too. Calendar-based reviews leave blind spots: a certification lapsing in March may go unnoticed until a December review, creating nine months of unrecognised exposure. Under DORA, financial entities must make their register available to the competent authority on request at any time, not just around the annual submission. NIS2 Article 21 similarly treats supply chain security as a baseline measure for other sectors.
The guide also highlights an accountability gap. Compliance owns third-party risk on paper, while the work runs through business units that lack the resources to do it. A Thomson Reuters Institute 2025 survey found 68% of C-suite leaders see compliance workload as a significant barrier to effectiveness.
Copla’s recommended starting point consists of four decisions: define a single register with minimum fields, set risk tiers and reassessment triggers, assign an owner to each stage, and assess platform needs against actual scale.
Copyright © 2026 FinTech Global
