A new third-party risk platform launched in mid-September 2026 with a headline statistic attached: research it cited suggested that 69% of organizations struggle to maintain consistent compliance standards across their third-party ecosystems. We could not trace the figure to an independent study, so it is best read as vendor-sponsored and indicative. It is still worth taking seriously, because it describes something risk teams recognise immediately. The gap is rarely that nobody did due diligence. It is that the due diligence looked different every time.
That distinction changes the remedy. If the problem were missing information, the answer would be longer questionnaires and more data feeds. If the problem is inconsistency, the answer is workflow: one tiering method, one approval path, one reassessment rhythm, one way of recording exceptions and one evidence trail, applied the same way whether the third party is one of twenty critical suppliers or one of five thousand long-tail vendors.
In Crest.Digital’s experience building third-party risk programmes for global enterprises, this is the point where maturity is won or lost. Programme maturity is less about how sophisticated the assessment is for a single vendor and more about whether the same discipline holds at scale.
Crest.Digital’s AI-powered TPRM platform runs tiering, due diligence, approvals, monitoring and reassessment as one connected workflow with a full audit trail.
Explore the TPRM PlatformWhat the 69% Figure Does and Does Not Tell You
Vendor surveys are marketing instruments as much as research, and a number attached to a product launch deserves the same scepticism you would apply to any claim. What it does tell you is directional. Independent work points the same way: KPMG’s 2026 global TPRM survey and the Ncontracts 2026 State of Third Party Risk Management report both track how organizations are trying to operationalise and scale their programmes, and the operational burden of doing so consistently is a recurring theme in the profession.
Why Compliance Standards Drift Across Third Parties
Inconsistency has predictable causes, and almost none of them are about effort. Procurement in one region onboards through a portal while another uses email. Business owners self-assess inherent risk and round it down to speed up approval. Reassessment calendars live in individual inboxes. Exceptions are granted verbally to keep a project moving and never expire. Evidence is attached to a ticket in one system and a shared drive in another.
Each of those is a small variation. Together they create the situation auditors describe in findings: policy says one thing, practice shows several. The distinction we draw in vendor onboarding versus vendor governance applies here. Onboarding is an event. Governance is the repeatable system that keeps every later decision aligned with the first one.
Regulated sectors feel this most. Supervisors in banking, insurance and critical infrastructure increasingly expect firms to evidence a proportionate, risk-based approach across all third parties, not just the headline ones. The EU DORA regime for critical ICT third-party providers and the direction of US and UK supervision all reward firms that can show consistent process, which is why our guide to operational resilience in TPRM treats workflow as a control in its own right.
The Workflow Chain That Makes Compliance Repeatable
Think of the lifecycle as a chain where each link hands a defined output to the next. If any link is informal, consistency breaks there. The six links below cover the full sequence from intake to audit trail.
Onboarding intake
One front door for every new third party, with a standard request that captures scope, data access, geography and business owner. Without it, tiering starts from incomplete facts.
Inherent risk and tier
Score inherent risk by the same logic every time and assign a tier that drives everything downstream: depth of due diligence, approval level and reassessment cadence.
Due diligence and questionnaire
Match the depth of screening, financial, adverse media and questionnaire review to the tier, and collect evidence rather than assertions.
Approval and conditions
Route approval to the right authority by tier, record the evidence relied upon and attach any conditions as trackable obligations.
Monitoring, issues and exceptions
Monitor continuously between reviews, turn findings into owned actions with due dates, and log every exception with an owner and an expiry.
Reassessment and audit trail
Trigger reassessment by cadence or by event, and keep an immutable record of who decided what, when and on what evidence.
Two design principles keep the chain honest. First, the tier is the master variable: depth of diligence, approval authority and reassessment frequency should all be derived from it, not negotiated per case. Second, every handoff should leave evidence. This is the logic behind our vendor risk assessment checklist and the end-to-end view in vendor lifecycle management from onboarding to exit.
Executive Takeaway: Consistency Is Measured, Not Declared
- Standardise the tier: one inherent-risk method, applied by the same rules in every business unit and region.
- Derive the rest from it: diligence depth, approval authority and reassessment cadence all follow the tier.
- Govern exceptions: every exception has an owner, a reason and an expiry, and is reported to the risk committee.
- Keep evidence in one place: an auditor should be able to sample any third party and see the same decision sequence.
- Automate the repeatable steps: chasing, reading, flagging and tracking are where agents add consistency without removing accountability.
Where Agentic AI Fits: Consistency at Scale, Humans in Control
Workflow discipline is easy to specify and hard to sustain manually. This is where agentic AI earns its place. AI agents can run the repetitive, rule-bound steps the same way every time: sending evidence requests and following up, reading submitted certificates and policies against the control standard, flagging changes in screening or financial signals, and tracking remediation to closure. Because agents apply the same logic to the fiftieth vendor as to the five-thousandth, they attack the inconsistency that drives the gap.
What agents should not do is own the decision. Tier overrides, exception approvals and risk acceptance stay with named humans, with the agent preparing the evidence and recording the outcome. That human-in-the-loop pattern, and the need to log what each agent did and why, is the same principle we set out in why AI agents need audit trails. For continuous testing of the controls themselves, Crest.Digital’s Agentic GRC practice extends the same approach beyond vendors into internal controls.
TPRM Agents handle vendor outreach, questionnaire intelligence, continuous monitoring and risk-based scoring, with every conclusion reviewable by your team. Where internal capacity is thin, Crest.Digital also delivers the programme as a managed service.
How to Measure Consistency Across Your Third-Party Portfolio
If you cannot measure consistency, you cannot manage it. A small set of metrics, reported by business unit and region, shows quickly where practice diverges from policy. Start with the share of third parties tiered using the standard method, the percentage of reassessments completed on schedule by tier, the count and age of open exceptions, and the time from onboarding request to approval. Add the proportion of approvals with complete evidence and the closure rate for issues and actions.
Internal audit can use the same measures as a sampling frame. The IIA Global Internal Audit Standards emphasise evidence-based, risk-focused assurance, and a workflow that records its own decisions makes that assurance cheaper and more convincing. Pair the metrics with continuous third-party assurance and the audit conversation shifts from reconstructing what happened to confirming that the process ran as designed.
The practical starting point is modest. Pick one tier, usually the critical vendors, document the chain above, measure it for a quarter and fix the largest divergence. Expand to the next tier once the first runs predictably. The aim is not to eliminate judgement but to make sure judgement is exercised inside a consistent frame, and that the frame is visible to the board, regulators and auditors.
Crest Perspective
Risk programmes that treat third-party governance as a compliance checkbox are consistently underprepared when a material vendor incident occurs. The programmes that withstand regulatory scrutiny are not necessarily the most technologically sophisticated — they are the ones where risk tiering is documented, escalation paths are tested before they are needed, and the board receives accurate, timely information about the organisation’s most critical vendor dependencies.
Frequently Asked Questions
The third-party compliance gap is the difference between the standards an organization says it applies to third parties and the standards it can show were applied consistently, in every case, with evidence. It usually appears not because due diligence was skipped, but because tiering, approvals, reassessments and exceptions are handled differently by different teams, regions or business units. A vendor-sponsored figure circulated with a September 2026 platform launch suggested that around 69% of organizations struggle to maintain consistent compliance standards across their third-party ecosystems; that number should be treated as indicative rather than an independent benchmark, but the pattern it describes is widely reported by practitioners.
A one-time assessment is a task. Consistency is a system. To be consistent, every third party must be tiered by the same inherent-risk logic, routed through the same approval path, reassessed on a cadence that matches its tier, and have exceptions recorded with an owner and an expiry date. As portfolios grow into the thousands, spreadsheets, email threads and personal judgement stop scaling, and small inconsistencies compound into audit findings. Workflow design, rather than additional questionnaires, is what closes the gap.
A defensible workflow covers onboarding, inherent-risk scoring and tiering, due diligence, questionnaire collection, approval, continuous monitoring, issue and action tracking, reassessment, and an audit trail across all of it. Each stage needs a named owner, a defined trigger, a service level and a record of what evidence was relied on. The test is whether an auditor can pick any third party at random and see the same sequence of decisions, with the same documentation, as for any other third party of the same tier.
AI agents are well suited to the repetitive, rules-bound parts of the lifecycle: chasing outstanding evidence, reading submitted documents against a control standard, flagging changes in screening or financial signals, and tracking remediation to closure. Agentic AI does not remove accountability. It makes the process consistent and fast, while humans stay in the loop to approve tier changes, accept exceptions and sign off on risk decisions. Crest.Digital's TPRM Agents and AI-powered platform are built around that division of labour.
Useful consistency metrics include the percentage of third parties tiered using the standard method, the share of reassessments completed on schedule by tier, the number and age of open exceptions, the average time from onboarding request to approval, the proportion of approvals with complete evidence, and the closure rate for issues and actions. Reporting them by business unit and region quickly reveals where practice diverges from policy, which is where audit findings tend to originate.