Skip to content
Sign in
Artwork for Third Party
Third Party · August 12 · 37 min

Your TPRM Program Isn't Fixable

Your third-party risk program is probably built on questionnaires, and you already know they don't really work. So the real question is not how to make them better. It's whether you should tear the whole thing down and start over.In this episode, Jeffrey Wheatman, Bob Maley, and Ferhat Dikbiyik get honest about what it takes to rebuild a TPRM program from the ground up. They dig into why the hardest part isn't the tooling, it's breaking the mental model you've been committed to for years. Drawing on the idea of creation and destruction, they walk through what they would keep, what they would throw out, and why using AI to speed up a broken process just gets you to the wrong answer faster. In this episode, you will learn: Why incremental improvement is the trap, and when a program needs a full rebuild instead of a refresh What the questionnaire industry is really protecting, and what could actually disrupt it The three things Bob and Ferhat would build first if they started from scratch Whether you can outsource a TPRM program, and where that logic breaks down Why AI model cards may replace stacks of AI questionnaires How to shift from assess-everybody to monitor-everybody and assess by exception If you have ever inherited a program you did not build and wondered whether to fix it or start over, this conversation is for you.

0:00-37:42
Play in

transcript

No transcript — this publisher did not publish one.

show notes

Your third-party risk program is probably built on questionnaires, and you already know they don't really work. So the real question is not how to make them better. It's whether you should tear the whole thing down and start over.In this episode, Jeffrey Wheatman, Bob Maley, and Ferhat Dikbiyik get honest about what it takes to rebuild a TPRM program from the ground up. They dig into why the hardest part isn't the tooling, it's breaking the mental model you've been committed to for years. Drawing on the idea of creation and destruction, they walk through what they would keep, what they would throw out, and why using AI to speed up a broken process just gets you to the wrong answer faster.

In this episode, you will learn:

  • Why incremental improvement is the trap, and when a program needs a full rebuild instead of a refresh
  • What the questionnaire industry is really protecting, and what could actually disrupt it
  • The three things Bob and Ferhat would build first if they started from scratch
  • Whether you can outsource a TPRM program, and where that logic breaks down
  • Why AI model cards may replace stacks of AI questionnaires
  • How to shift from assess-everybody to monitor-everybody and assess by exception


If you have ever inherited a program you did not build and wondered whether to fix it or start over, this conversation is for you.

more episodes

All episodes