From compliance to capability: the evolving role of third-party risk management in strengthening organisational resilience

Abstract

The financial sector is highly dependent on ICT third-party service providers for the delivery of critical business processes. The Digital Operational Resilience Act (DORA), which came into force on 17 January 2025 and applies to all European Union financial institutions, has significantly increased the regulatory and managerial relevance of third-party risk management (TPRM) as a core component of organisational resilience governance. As TPRM evolves as a strategic capability within non-financial risk management, understanding expected regulatory and organisational developments within a 3- to 5-year horizon is essential for strengthening resilience and supporting effective management decision-making. This study examines expert perspectives on the future development of ICT TPRM in the Baltic banking industry. It is based on thirteen semi-structured interviews with professionals involved in ICT third-party governance and risk management, analysed using qualitative content analysis. The findings suggest that while core TPRM principles will remain stable, managerial focus will shift towards execution quality, organisational maturity, and embedding resilience thinking into governance processes. Experts expect greater standardisation, enhanced board-level visibility, expanded oversight of fourth and Nth parties, and increased use of automation and analytical tools. TPRM is transitioning from a compliance-driven function towards a strategic management capability supporting organisational resilience through improved transparency, accountability, and higher execution quality.