A perfect vendor questionnaire can still leave you exposed. That's the uncomfortable starting point for this week's conversation with Mike Day, Financial Services TPRM lead at Deloitte and host of Third Party Therapy — because the failures that actually hurt you increasingly live three or four tiers deep, where you have no contract, no direct oversight, and sometimes no idea the dependency even exists.
We dug into why DORA gets misread as a documentation exercise when its real intent is operational resilience — knowing which third parties keep critical services running, de-risking them, and proving you can absorb a disruption. From there we got specific about fourth- and nth-party risk: how teams are pairing questionnaires with monitoring tools and outside data to surface hidden relationships and concentration risk before they become headlines.
AI raises the stakes here. A lot of "AI-enabled" vendor products lean on the same small handful of frontier model providers — which means a single outage or geopolitical event can ripple across an entire sector at once. We closed on where generative AI genuinely helps (accelerating SOC 2 and vendor doc review) versus where it doesn't, and Mike's simple discipline for cutting through it all: ask each question once, and don't build a "data buffet" that slows your whole program down.
Give it a listen, and let us know — what part of your third-party risk program feels most "stuck" right now?
Listen here: https://www.buzzsprout.com/2120821/episodes/19803694
From Third Party Threat Hunting™ (TPTH™)
Put it to work
Which of your vendors are critical?
The free eight-step vendor checklist: sort your vendors into systemically critical, critical or ordinary.
Get the checklist →Ready for the exam?
The free exam and audit readiness scorecard: eight questions to ask yourself before an examiner or auditor does.
Get the scorecard →Vendor AI risk
The free BEACON™ class: 19 minutes on the six categories of vendor AI risk, with a real case to work through.
Take the free class →