The challenge
Cyberattacks are increasingly entering organisations through partners and suppliers. As a result, the importance of Third Party Risk Management (TPRM) is growing rapidly. An organisation’s cyber resilience is now closely tied to that of the parties it works with.
Regulators are raising the bar. Frameworks such as DORA and NIS2 require organisations to have a clear view of their dependencies and to demonstrate how third-party risks are being managed.
This is driving significant compliance pressure. Effective TPRM still involves a large amount of manual work, while processes are often fragmented. Contracts need to be reviewed, assessments evaluated, assurance reports collected, and suppliers validated. Many of these steps are time-consuming and prone to error.
At the same time, standardisation is often lacking. Information is exchanged through lengthy questionnaires and shared documentation, all of which must be manually assessed before determining whether a supplier meets the required standards. Meanwhile, organisations are expected to provide faster, demonstrable assurance, while suppliers expect timely and consistent responses to avoid delays in deals or contract renewals.
The approach
KPMG helps organisations make their TPRM function more efficient and resilient using AI, without removing the human role from the process.
In contract management, AI language models analyse contract clauses and compare them with current regulations and best practices. Missing provisions, such as incident notification timelines or patch SLAs, are automatically flagged and supplemented with concrete drafting suggestions. Legal teams stay in control, but start from an annotated document rather than a blank page.
AI also reduces manual effort in compliance activities. Submitted documents, such as SOC or ISAE reports and penetration test results, are automatically analysed and summarised into key controls and remaining risks. This allows organisations to set priorities faster and gives suppliers earlier insight into potential gaps.
AI also helps keep supplier registers up to date. By incorporating external signals, for example through RiskRecon, domains, certificates and digital assets are automatically linked to suppliers and sub-processors. The result is a dynamic view of third and fourth parties that highlights changes and makes risk trends visible.
The result
Applying AI within TPRM processes significantly reduces administrative workload while improving the consistency and traceability of risk management.
Document analysis, contract reviews and supplier assessments become faster and more consistent. Lead times are reduced from weeks to days, or even hours, while organisations gain clearer insight into risks across their supplier landscape.
The result is a scalable and future-ready TPRM approach, with stronger compliance and faster, better-informed decision-making.
The team that made the difference
A multidisciplinary AI Factory team from KPMG Netherlands supports organisations in digitising and improving Third Party Risk Management processes. By combining expertise in AI and data with knowledge of cybersecurity, governance and Digital Process Excellence, they help organisations make TPRM more efficient, consistent and future-proof.
