How AI is Transforming Third Party Risk Management
AI is transforming third-party risk management (TPRM) for global enterprises across three distinct waves: machine learning (automating processes and detecting anomalies), Gen AI (providing contextual, conversational insights) and agentic AI (autonomously initiating risk mitigations).
But, despite AI’s potential, adoption is slowed by organisational complacency, legacy systems and leadership misalignment.
Dean Alms, Chief Product Officer at Aravo, recently took the time to discuss about how the company is helping to combat this.
Dean leads the development and execution of the company's product strategy, with a focus on helping organisations modernise and scale their third-party risk management (TPRM) programme.
He has spent most of his career at the intersection of technology, data and business outcomes – working across enterprise software, AI platforms and highly regulated industries.
Dean joined Aravo to help evolve how it considers risk in a world where change is constant and complexity is the norm.
Aravo provides third-party risk management solutions powered by intelligent automation. It supports Global 2000 enterprises as they manage increasingly complex ecosystems of vendors, partners and suppliers – all while navigating evolving regulations and security threats.
Its Intelligence First platform is purpose-built for this space. It uses AI to streamline time-consuming processes and surface insights that help risk teams act faster and smarter.
Whether a company is focused on cybersecurity, ESG or regulatory risk, Aravo helps build programmes that are not just efficient, but future-ready. It is trusted by over five million third-party users and 5,000 corporate users in more than 170 countries - a reflection of both the global scale of the challenge of managing third party risk across complex supply chains and regulatory landscapes, and the trust it has earned in helping solve it.
Dean told Procurement Magazine about how AI is addressing the gap in TPRM.
Given that 60% of data breaches in large organisations over the past year involved a third party, what are the most critical gaps in traditional TPRM processes that AI can address?
I typically see three major gaps in an organisation’s TPRM strategy. First, visibility. Most companies lack a complete view of their third-party landscape. Only 60% have visibility into tier-one suppliers, and just 30% can see beyond that. Second, reactivity. Many teams wait until something breaks before they act. And third, data overload. There’s no shortage of information – but there's often no easy or clear way to prioritise what matters most.
AI will close those gaps. It can scan massive volumes of structured and unstructured data to identify emerging risks – whether that’s a breach, a financial signal or an operational disruption. It cuts through the noise, triages risk signals, reduces false positives and delivers actionable insights to decision-makers. Simply put, it will help risk teams shift from playing catch-up to getting ahead of threats before they impact the business.
Can you explain the three waves of AI – machine learning, generative AI and agentic AI – and how each is reshaping the TPRM landscape?
The first wave, machine learning, is already driving real change. It helps automate and streamline key processes like supplier onboarding, risk scoring and continuous monitoring. It uncovers patterns in large datasets that humans would miss, flags anomalies and helps teams prioritise their efforts.
The second wave, generative AI, is where things really start to feel transformative. Instead of clicking through dashboards or combing through policy documents, users will soon just ask a question – “What are the key risks for this vendor in Southeast Asia?” – and get an answer that’s contextual and actionable. It democratises access to insights and helps teams work more efficiently, especially when resources are limited.
Finally, the third wave, agentic AI, is the most forward-looking. This is AI that acts – initiating mitigation plans, rejecting non-compliant vendors, adjusting controls as risks evolve. It moves beyond assistance to autonomy. And it will fundamentally shift how organisations manage risk – from manual workflows to intelligent, adaptive systems.
Despite AI’s potential to centralise and modernise TPRM, adoption remains slow. What are the main barriers organisations face and what practical steps can they take to overcome challenges related to cost, legacy technology and limited expertise?
All three waves of AI are still in the early stages – but even as the tech develops, it’s not just the cost or the effort required to upgrade legacy systems that will slow its adoption. Many organisations overestimate their risk maturity and take a “why fix what isn’t broken?” mindset. They assume a few dashboards and reports mean they’re covered, but in reality, processes are often manual, siloed and reactive – leading to blind spots and limited collaboration.
Leadership misalignment is another major barrier, as is a lack of internal governance and AI usage policies. While there is a drive to adopt AI to accelerate and improve certain tasks, defining a strategy, business use cases and evaluation criteria is advised. This does and should slow adoption, especially as it is important to apply risk management criteria to adopting new technologies. To be sure, risk management is a strategic and organisational function, not just a compliance exercise. Without executive sponsorship, business rules, adoption policies and a clear roadmap, even the most advanced technology won’t deliver results.
The smartest approach is to start small – but with purpose. Focus on one or two high-impact use cases where AI can quickly prove value to leadership. Align implementation with governance structures, invest in training and designate a program champion to drive adoption, secure buy-in and sustain momentum.
How can organisations develop an AI roadmap for TPRM that aligns with their risk maturity and broader business objectives?
It starts with getting honest about where you are. Is your programme mostly manual, reactive or fragmented? Or do you already have some integrated processes and defined ownership? That baseline tells you where AI can help most.
Next, be honest about your risk appetite. Are you a first mover or do you prefer to simply optimise what’s already working? That answer should guide how aggressive or cautious your roadmap is.
From there, prioritise. Identify your team’s biggest bottlenecks – whether it’s document review, regulatory tracking or supplier segmentation – and focus AI adoption in those areas first.
But here’s the key: build with intent. There’s real pressure to move fast; but skipping the strategy phase leads to poor outcomes. The most successful organisations take a “think big, start small, grow fast” approach. Start by solving a real problem, build an implementation framework, define success metrics and make sure the business-side has bought in. When AI is aligned with business objectives and risk culture, it becomes a multiplier – not a gamble.
What are some real-world examples or use cases where AI has successfully improved third-party risk management and what measurable benefits have organisations seen as a result?
Over the past half dozen years, we’ve witnessed AI deliver tangible value to our customers. Our first machine learning application streamlines and enhances third-party onboarding by analysing decision patterns within each customer’s Aravo instance. This enables the system to recommend optimal next steps for processing, approving or denying engagements – accelerating workflows and improving consistency.
We’re also leveraging AI to dramatically reduce false positive media reports by over 85%. This not only slashes manual review time and effort but also boosts accuracy and allows teams to focus on higher-value activities. For example, one customer was able to reduce their adverse media review team from 20 people to just two, while transforming response times from days to mere minutes.
In every case, our AI solutions operate exclusively within each customer’s own data environment, referencing decision confidence levels to ensure transparency and trust. The result is measurable, sustained improvement in program performance and resource allocation. And we’re just getting started. We anticipate that AI will benefit TPRM programmes and practitioners in highly visible and meaningful ways over the next few years.
It’s an exciting time to be working in this market.
Explore the latest edition of Procurement Magazine and be part of the conversation at our global conference series, Procurement & Supply Chain LIVE.
Discover all our upcoming events and secure your tickets today.
Procurement Magazine is a BizClik brand
