In many organizations, Third-Party Risk Management (TPRM) suffers from a identity crisis. Is it a legal function? A procurement checkpoint? A cybersecurity discipline?
When these departments operate in silos, vendors receive repetitive requests, internal teams fight over friction points, and critical risk items slip through the cracks.
In our latest Third Party Threat Hunters discussion, Heather Kadavy shared key insights from her 30+ year career leading enterprise risk programs and her work at the Third Party Risk Association (TPRA) on how to align disparate internal teams into a cohesive risk governance engine.
Breaking Down the Silo Triad
To build a high-performing risk management framework, organizations must align three distinct viewpoints:
- Procurement / Sales
- Cybersecurity / Risk
- Legal / Compliance
"Train the Trainer, Train Their Successors"
One of the most practical strategies Heather shared during the episode is embedding sustainable risk literacy across the company.
If risk knowledge lives inside the head of a single TPRM analyst, the program crumbles the moment that person leaves. Building long-term resilience requires:
- Creating a Shared Vocabulary: Ensure business units and executive leadership use consistent definitions for "high risk," "critical vendor," and "acceptable exposure."
- Empowering Business Unit Champions: Train department managers to perform preliminary risk scoping before procurement even begins.
- Cultivating Empathy for Vendors: Vendors are overwhelmed by thousands of unique questionnaires. Streamlining requests to standard frameworks (like TPRA or ISO) yields faster, more accurate answers.
Summary
At its core, risk management is a collaborative human endeavor. By pairing automated workflows with strong cross-departmental relationships, security leaders can protect their supply chain without slowing down business growth.
Listen to the complete episode with Heather Kadavy on *YouTube**.*
From Third Party Threat Hunting™ (TPTH™)
Put it to work
Which of your vendors are critical?
The free eight-step vendor checklist: sort your vendors into systemically critical, critical or ordinary.
Get the checklist →Have us run it
Managed third-party threat hunting: practitioners on your systemically critical vendors, automation on the rest.
See the managed tiers →