Third Party Risk Management (TPRM) Principal Consultant
PA Consulting · London, United Kingdom · hybrid
We believe in the power of ingenuity to build a positive human future.
As strategies, technologies, and innovation collide, we create opportunity from complexity.
Our teams of interdisciplinary experts combine innovative thinking and breakthrough technologies to progress further, faster. Our clients adapt and transform, and together we achieve enduring results.
We are over 4,000 strategists, innovators, designers, consultants, digital experts, scientists, engineers, and technologists. And we have deep expertise in consumer and manufacturing, defence and security, energy and utilities, financial services, government and public services, health and life sciences, and transport.
Our teams operate globally from offices across the UK, Ireland, US, Nordics, and Netherlands.
PA. Bringing Ingenuity to Life.
Third Party Risk Management (TPRM)
Location: UK / Hybrid
Sector Coverage: Banking, Insurance, Asset & Wealth Management, Financial Market Infrastructure, Regulatory Bodies
About the Role
We are seeking an exceptional Third Party Risk Management (TPRM) leader to join our Financial Services practice.
This role is suited to an individual who combines deep industry expertise with consulting experience and has helped major financial institutions navigate increasingly complex third-party ecosystems. You will be recognised as a trusted advisor to executives, boards and regulators, with a proven track record of designing, transforming and operating leading TPRM, outsourcing and operational resilience capabilities.
You will bring experience gained within banks, insurers, asset managers or regulators, complemented by a consulting background that enables you to solve complex challenges, lead large-scale transformations and shape strategic thinking across organisations.
As a senior leader, you will help clients address the challenges posed by cloud adoption, AI, critical third parties, operational resilience, concentration risk, emerging regulation and increasingly interconnected supply chains.
Key Responsibilities
TPRM Strategy and Transformation
- Lead the design and transformation of enterprise-wide TPRM frameworks, operating models and governance structures.
- Advise Boards and Executive Committees on third-party, outsourcing and supplier-related risks.
- Develop target operating models that align procurement, risk, resilience, compliance, legal and technology functions.
- Lead large-scale TPRM transformation, remediation and regulatory change programmes.
- Define risk appetites, control frameworks, policies, standards and key risk indicators.
Regulatory and Supervisory Expertise
- Advise clients on current and emerging regulatory requirements, including:- PRA SS2/21
- FCA Operational Resilience
- DORA
- EBA Outsourcing Guidelines
- Basel operational risk expectations
- Solvency II outsourcing requirements
- Critical Third Party (CTP) regulation
- Lead regulatory readiness assessments, remediation programmes and assurance reviews.
- Support interactions with regulators, internal audit and external assurance providers.
- Translate complex regulatory requirements into practical and sustainable controls.
Operational Resilience and Outsourcing
- Assess third-party support of important business services and critical operations.
- Develop approaches to supplier resilience testing, substitution and exit planning.
- Lead scenario testing involving critical suppliers and outsourced service providers.
- Advise on resilience considerations associated with cloud services, technology providers and shared industry infrastructure.
AI, Technology and Digital Supplier Risk
- Design governance and risk management frameworks for AI-enabled suppliers and service providers.
- Conduct due diligence assessments of AI, Generative AI and machine learning vendors.
- Evaluate risks associated with:- AI governance and accountability
- Model transparency and explainability
- Bias and fairness
- Data privacy and sovereignty
- Intellectual property exposure
- Model drift and emerging AI threats
- Advise on management of hyperscaler, SaaS, PaaS and IaaS provider risk.
Executive Leadership and Client Development
- Build trusted relationships with CROs, COOs, CIOs, CISOs, Heads of Procurement and regulators.
- Lead multi-disciplinary teams across complex engagements.
- Develop thought leadership and market propositions.
- Contribute to business development, account growth and go-to-market activities.
- Mentor and develop future TPRM leaders.
Technical Expertise Required
The successful candidate should demonstrate extensive expertise across the end-to-end supplier lifecycle.
Third Party Risk Management Frameworks
- TPRM policy, standards and governance design.
- Risk appetite and control framework development.
- Supplier segmentation and criticality assessment methodologies.
- Risk-based tiering and monitoring approaches.
- Board and Executive-level reporting.
Third Party Registers and Inventory Management
- Design and implementation of:- Outsourcing registers
- Third-party inventories
- Service registers
- Supplier ownership models
- Development of data models linking suppliers, contracts, services, business processes and risks.
- Establishment of data governance and control frameworks across supplier ecosystems.
Due Diligence and Risk Assessment
Extensive experience designing and executing due diligence frameworks covering:
- Financial stability and viability
- Operational resilience
- Cyber security
- Information security
- Data privacy and protection
- Business continuity and disaster recovery
- ESG and sustainability
- Regulatory compliance
- Geographic and geopolitical risk
- Financial crime
- AI and model risk
- Fourth-party and nth-party dependencies
Critical Third Parties and Concentration Risk
- Assessment of systemic and sector-wide supplier risks.
- Development of concentration risk frameworks.
- Analysis of cross-industry dependencies.
- Experience assessing:- Cloud providers
- Payment infrastructures
- Technology platforms
- Market utilities
- Industry shared services
- Development of CTP impact assessments and risk mitigation strategies.
Fourth-Party and Supply Chain Risk
- Supply chain mapping and dependency analysis.
- Subcontractor oversight frameworks.
- Fourth-party visibility and assurance programmes.
- Ecosystem risk modelling and monitoring.
Operational Resilience
- Important Business Service mapping.
- Impact tolerance assessments.
- Third-party resilience testing.
- Exit and substitution planning.
- Recovery and continuity capability assessments.
- Scenario and stress testing.
TPRM Data, Analytics and Technology
Experience with leading platforms including:
- ServiceNow
- Archer
- MetricStream
- ProcessUnity
- OneTrust
- Coupa
- SAP Ariba
- Fusion Risk Management
Alongside experience of:
- Workflow automation.
- Control monitoring.
- Supplier risk analytics.
- Continuous monitoring solutions.
AI-enabled risk assessment and monitoring tools.
Experience Required
Essential
- 8-12+ years of experience in Third Party Risk Management, Operational Resilience.
- Experience gained across from industry and/or consulting environments.
- Demonstrable expertise within banking, insurance, asset management or financial regulation.
- Proven experience leading enterprise-wide TPRM transformations.
- Strong understanding of technology, cloud and digital supplier risk.
- Experience engaging directly with regulators, executive committees and boards.
- Strong commercial and client-facing capabilities.
Highly Desirable
- Experience working for a financial regulator or supporting regulatory supervision activities.
- Experience leading responses to regulatory findings, reviews or remediation programmes.
- Experience with AI governance and AI supplier risk management.
- Experience establishing operational resilience capabilities involving critical third parties.
- Thought leadership credentials within TPRM, outsourcing or operational resilience.
W