Third-party risk management works better when you treat it like an intelligence operation. Most organizations don't think about it this way, but the lens reveals gaps in how they assess vendors and where they're wasting effort on low-value activities.
Third-party risk management is an intelligence operation. That might be stating the obvious, but I've actually never heard somebody, I've never heard anyone articulate it that way, that pointedly. And if that's true, then I think that organizations will be, if you apply that intelligence operations lens to third-party risk management, then I think you really have to take a critical look about what your current operations are and what's the value of the different activities. That you're performing and perhaps kind of reconstruct
