Most procurement organizations can identify supplier risks, but few can anticipate how disruptions will affect cost, continuity and performance across their networks. New research from ProcureAbility and The Hackett Group suggests the next step in third-party risk management is not more monitoring, but better analytics and faster decision-making.
Analytics Gaps Keep TPRM Stuck In Reactive Mode
The ProcureAbility and Hackett Group study, ‘From Insight to Impact: Analytics-Led Third-Party Risk Performance Management’, finds that nearly three-quarters of procurement organizations have yet to implement advanced risk programs, largely because their data, tools, and processes are not fit for purpose. Although 90% report that they track basic supplier indicators such as financial health and location exposure, only about 7% are using scenario modeling to understand how future disruption could cascade across their supply base. The result is a risk function dominated by after-the-fact issue handling rather than forward-looking risk allocation.
The report highlights that 62% of respondents describe their supply risk approach as only partially deployed, with practices, processes, and systems still immature. A further 13% have no formal supply risk management framework at all, leaving critical categories dependent on informal judgments and local workarounds. Industry filings and recent incident disclosures show that this lack of structure tends to surface during geopolitical shocks, port closures, and cyber events, where organizations struggle to identify which suppliers, contracts, and sites are truly mission-critical.
Darshan Deshmukh, president of ProcureAbility, notes that leading organizations are deliberately breaking away from fragmented management of risk, cost, and performance in favor of a unified operating model that links strategy, governance, and analytics. In these more advanced environments, supplier data, contract levers, and performance signals are consolidated into a single decision layer, enabling commercial teams to adjust allocations, pricing mechanisms, or service levels before disruption erodes margin. That approach aligns with wider market moves toward integrated supply chain risk platforms, where procurement, supply chain, and finance share a common view of exposure.
Integrated Risk And Performance Now a Commercial Imperative
According to the research, 68% of procurement organizations cite supply chain disruptions driven by geopolitical tensions, shifting trade policy, and chokepoint incidents as the primary obstacle to escaping a state of ‘permacrisis. Yet most still treat TPRM as a monitoring exercise rather than as an engine for commercial design. Monitoring alone flags issues, but it does not answer how to reconfigure contracts, rebalance supplier portfolios, or redesign categories to absorb shocks at acceptable cost.
Organizations that are beginning to pull away from the pack are treating risk management and analytics as a single capability that converts supplier signals into concrete sourcing and contracting decisions. That includes using risk scores and disruption alerts to trigger pre-defined playbooks for allocation changes, switching to pre-qualified alternates, or activating contingency clauses for volume, indexation, or service rerouting. Where contract architectures embed elements such as capacity reservation, dual-sourcing expectations, and audit rights, TPRM data can be translated more quickly into enforceable actions.
Regulatory developments are reinforcing this shift. Financial services and critical infrastructure operators already face heightened expectations for third-party risk governance, and broader supplier transparency requirements in areas such as cybersecurity, ESG, and supply chain due diligence are moving into mainstream sectors. Public guidance and enforcement trends indicate that regulators increasingly expect firms to evidence not only that they collect supplier risk data, but also that they use that information systematically in vendor selection, contract design, and ongoing performance management.
From an economics perspective, the absence of mature TPRM creates quiet but material drag on cost and margin. Without robust analytics, procurement teams struggle to quantify the trade-offs between securing capacity, diversifying suppliers, and locking in pricing mechanisms that balance volatility against leverage. That often results in either overpaying for perceived safety or underinvesting in resilience until the next disruption forces emergency measures at premium cost.
The Next Step Is Operationalizing Risk Intelligence
As supplier networks become more complex and regulatory expectations increase, the value of TPRM will depend on how effectively organizations connect risk insight to sourcing, contracting and allocation decisions. Companies that can translate emerging supplier signals into timely commercial actions will be better positioned to protect continuity, control costs and respond to disruption without resorting to expensive emergency measures.