Advancing third-party risk management and operational resilience

Against the backdrop of the Monetary Authority of Singapore’s (MAS) recent consultation papers on Third-Party Risk Management (TPRM) and Operational Risk Management (OPRM), financial institutions are reassessing how they manage increasingly complex third-party ecosystems, operational dependencies, and emerging technology risks.

To explore these evolving issues, PwC sought input from a number of financial institutions through targeted discussions focused on the practical implications of the proposed regulatory expectations, current industry challenges, and emerging approaches to strengthening operational resilience.

While the consultation papers address distinct risk disciplines, input from financial institutions pointed to a common underlying objective: enabling organisations to better anticipate, withstand, respond to, and recover from disruption in an increasingly interconnected operating environment.

The discussions covered third-party risk management, operational resilience, operational risk management, AI governance, business architecture, data and automation. To support open and candid input, institutions and contributors have been anonymised. The observations in this paper consolidate industry perspectives and should not be attributed to any individual institution.

A consistent theme across the input received was that the next phase of TPRM, OPRM and operational resilience maturity will be defined less by additional controls and periodic assessments, and more by organisations’ ability to integrate risk disciplines, connect data, automate oversight, and continuously monitor emerging risks across their business and third-party ecosystems.

While third-party risk, operational risk, technology risk, business continuity, and AI governance are often managed separately, many organisations increasingly view operational resilience as the unifying outcome that these disciplines collectively support. 

Rather than treating resilience as a compliance exercise, organisations are placing greater emphasis on understanding how critical services are delivered, where key dependencies exist, and how disruptions could propagate across internal functions, technology platforms, and third-party providers.

Resilience requires organisations to move beyond risk identification and towards a more holistic understanding of service continuity, recovery capabilities, and interdependencies across the operating model. This shift is driving closer integration between risk disciplines and elevating operational resilience as a strategic business capability rather than a standalone risk programme.

One of the strongest themes emerging across the discussions was the recognition that traditional approaches to third-party oversight are no longer sufficient in a rapidly changing risk environment.

Historically, organisations have relied heavily on due diligence exercises, periodic assessments, annual reviews, and scheduled testing activities to evaluate third-party risk. While these practices remain important, many organisations consistently highlighted their limitations in identifying changing risk profiles between review cycles.

As third-party ecosystems become increasingly dynamic, organisations are seeking to develop continuous monitoring capabilities that provide ongoing visibility into supplier performance, operational disruptions, cyber threats, financial deterioration, concentration risks, and emerging technology risks.

The future of risk management is not about conducting more assessments. Rather, it is about transforming risk data into actionable intelligence through ongoing monitoring, early warning indicators, stronger situational awareness, and faster response capabilities. Continuous monitoring was widely viewed as a foundational capability underpinning both effective risk management and operational resilience. 

Discussions highlighted that AI is increasingly being viewed as a material risk consideration for financial institutions, with implications extending beyond technology and model risk into third-party risk, operational risk, compliance, cybersecurity and operational resilience. AI-enabled products and services can introduce complex and evolving dependencies, particularly where they rely on foundation models, cloud infrastructure, external data, subcontractors or other third-party capabilities. As AI systems change after deployment, their risk profiles may also shift, making one-time reviews insufficient.

Discussion also highlighted the importance of maintaining a current view of where AI is used, clear ownership and accountability, proportionate controls across the AI lifecycle, and ongoing monitoring of performance, change and external dependencies. Many organisations noted that these considerations should extend to third parties and subcontractors where AI supports service delivery. A recurring theme across the discussions was that AI governance should be embedded within third-party risk, operational risk, technology risk and operational resilience frameworks, enabling AI-related risks to be assessed consistently, monitored continuously and managed within the broader risk and control environment. 

Many organisations have developed separate frameworks covering operational risk, operational resilience, third-party risk, technology risk, business continuity management, and AI governance.

These frameworks often serve legitimate regulatory and business objectives, the cumulative effect can create duplication, fragmented ownership, inconsistent terminology, and reporting complexity.

As a result, there is growing industry interest in harmonising frameworks, establishing common taxonomies, and creating a shared language across risk disciplines. The objective is not necessarily to replace existing frameworks, but to improve alignment and reduce unnecessary complexity for businesses and risk teams alike.

Ultimately, greater integration is essential to achieve the broader objective of operational resilience and enable more effective risk-based decision-making.

There was strong industry consensus that the future of TPRM and OPRM depends on better connectivity between business architecture, process architecture, risk information, and technology platforms.

Organisations with more mature business and enterprise architecture capabilities appear better positioned to understand dependencies, identify concentration risks, map critical services, and strengthen resilience outcomes.

At the same time, many organisations already possess significant volumes of risk-related information. The challenge is not necessarily the lack of data, but the fragmentation of that information across multiple systems, functions, and processes.

Future investment priorities identified during the discussion include integrated risk data ecosystems, modernised governance, risk, and compliance (GRC) platforms, automated monitoring capabilities, enhanced dependency mapping, and actionable risk intelligence. Sustainable risk and resilience programmes will depend on better connected data and automation rather than additional manual processes and controls.

PwC’s discussions with financial institutions highlighted an important shift in industry thinking as organisations prepare for an increasingly resilience-focused regulatory environment.

While MAS’s proposed TPRM and OPRM enhancements address multiple aspects of risk management, the input received largely viewed them through a common lens: strengthening operational resilience across an increasingly interconnected ecosystem of people, processes, technology, data, and third parties.

Five themes consistently emerged across the discussions:

1. Operational resilience is becoming the strategic anchor
2. Continuous monitoring is replacing point-in-time risk oversight
3. AI governance is rapidly becoming a core risk management requirement
4. Risk frameworks require greater integration and harmonisation
5. Architecture, data and automation are key enablers of scalable risk management

Collectively, these themes suggest that the future state for many organisations will not be defined by additional controls, but by the ability to connect business architecture, risk information, third-party dependencies, AI governance, and continuous monitoring capabilities into an integrated, intelligence-driven operating model.