Certa Whitepaper

Global CeFPro® Whitepaper

Bridging the Productivity Gap in Third-Party Risk Management with AI April, 2025 | Supported by:

1

Contents

04

06 09 12 16 21 25 29 32

ABOUT US

About CeFPro & Certa

INTRODUCTION State of the industry Methodology

NAVIGATING THE CURRENT TPRM LANDSCAPE Coping strategies for stagnant budgets

Continual reliance on manual processes

THE BURDEN OF MANUAL TPRM WORKFLOWS

5

7

8

10 11

Manual data collection

13

Policy and compliance interpretation

15

Manual data validation

THE ROLE OF GENAI IN TPRM

14

Automatically creating and updating workflows

17

Automated filling of questionnaires and assessments

20

Analyzing third-party documents

CHALLENGES AND BARRIERS TO AI ADOPTION Data security concerns

Resource and budget constraints

BENEFITS AND ROI

18

22

24

Efficiency and productivity gains

26

Enhancing strategic flexibility

28

Better resource allocation

FUTURE READINESS WITH GENAI Conclusion

Executive summary: Certa’s reaction

ADDITIONAL DATA

Additional questions from survey Appendix

27

30 31

33 33 2

Table of Figures

07 08 10 11 13 15 22 24 26 27 28 32

FIGURE A: How have the number of third-party relationships changed for your organization over the past 2-3 years?

FIGURE B: To what extent has your budget for risk management changed during the same period?

FIGURE C: How would you manage an increased workload and responsibilities for your team without a proportionate increase in resources?

FIGURE D: Which of the following areas are still largely manual at your organization?

FIGURE E: How much time would you estimate a typical third party spends on answering questionnaires and assessments during your due diligence process?

FIGURE F: Collectively, how much time is typically spent by members of your team?

FIGURE G: What do you think are the biggest barriers to adopting such AI-driven solutions?

FIGURE H: What are the biggest challenges you face in managing third party risks?

FIGURE I: What percentage improvement in efficiency have you seen as a result of AI adoption?

FIGURE J: If your team suddenly had 10% more bandwidth starting next week, how would you use the extra resources?

FIGURE K: How likely are you to implement more GenAI solutions for TPRM in the next 1-2 years?

FIGURE L: How many third-party relationships does your organization currently have?

3

ABOUT US

About CeFPro & Certa Page 5

04 4

About Us

About CeFPro The Center for Financial Professionals (CeFPro) is an international research organization and the focal point for the global community of finance, technology, risk, and compliance professionals from across the financial services industry. CeFPro is driven by high-quality, reliable, primary market research. It has developed a comprehensive methodology that incorporates data from its global community that has been validated by an international team of independent experts.

Examples of some of CeFPro’s research include: • Non-Financial Risk Leaders: the most comprehensive independent study of trends, opportunities, and challenges within non-financial risk •

Fintech Leaders: an international survey to assess the status of the fintech industry and provide details for informed decisions on technology and business-related matters.

To find out more, visit www.cefpro.com/research

About Certa

Certa is the leading Third Party Risk Management (TPRM) solution. With its comprehensive Third Party Operating System (Third Party OS), Certa lets you manage risk across all third party types, all risk domains, all in one OS. Certa leverages AI across the third party lifecycle—automating onboarding, risk analysis, compliance, and monitoring. Its nocode workflows, AI-driven decisioning, and realtime data integrations help you adapt to evolving regulations and business needs. With full spectrum risk coverage, Certa delivers due diligence 80% faster, driving smarter and more efficient third party management for global enterprises.

5

INTRODUCTION

State of the industry Page 7

Methodology Page 8

06 6

INTRODUCTION

As supply chains expand, managing third-party relationships becomes more complex. Our survey indicates that 81% of firms have seen an uptick in third-party relationships in the last three years. Despite this, financial support for managing these risks hasn’t kept up. While 60% of respondents have seen their risk management budgets increase, 40% face stagnant or reduced funding.

This lack of funding creates a productivity gap, meaning that organizations don’t have the resources to keep up with their rising responsibilities. In the absence of a greater budget, organizations must learn to do more with less. This paper explores the productivity challenges in third-party risk management (TPRM) and how generative artificial intelligence (GenAI) can help overcome them.

Figure A: How have the number of third-party relationships changed for your organization over the past 2-3 years? *Data may not add up to 100% due to rounding

Significantly increased 16% Somewhat increased 65% Stayed the same 13% Somewhat decreased 4% Significantly decreased 2%

81% of firms report increased third-party relationships, yet 40% face stagnant or reduced risk management budgets.

7

INTRODUCTION

Figure B: To what extent has your budget for risk management changed during the same period?

*Data may not add up to 100% due to rounding

Significantly increased 13% Somewhat increased 47% Stayed the same 36% Somewhat decreased 3% Significantly decreased 1%

Methodology This report is based on a two-phase research process. Our survey engaged 131 organizations across several sectors, including banking, asset/wealth/investment management and insurance, focusing on varying sizes from those managing under $10 million to those with over $500 million assets under management (AUM). Additionally, research with industry experts through one-to-one calls provided deeper insights and real-world context to the survey findings. Key demographics of the respondents included:

Sector representation: A significant portion (41%) of respondents were from banks.

Size of institutions: Nearly half (46%) of participants reported having under $10 billion in AUM. Third-party relationships: A substantial portion (47%) of respondents indicated that their organizations manage more than 1,000 third-party relationships.

8

NAVIGATING THE CURRENT TPRM LANDSCAPE

Coping strategies for stagnant budgets Page 10

Continual reliance on manual processes Page 11

09 9

NAVIGATING THE CURRENT TPRM LANDSCAPE

Coping strategies for stagnant budgets When faced with increased workloads and responsibilities without a corresponding resource increase, 68% of respondents said they would implement automation tools to streamline processes, reinforcing technology as a strategic response to budget constraints.

Figure C: How would you manage an increased workload and responsibilities for your team without a proportionate increase in resources?

(Select all that apply) Implement automation tools to streamline processes 68%

Prioritize and delay non-critical tasks 63% Advocate for additional resources (e.g. budget, temporary staff) 47% Redistribute tasks among existing team members 47% Outsource specific tasks or projects to third-party providers 30% Other (please specify) 3%

OTHER: basu Everything is largely manual!

Getting functional owners to respond timely

However, automation through conventional information technology (IT) systems has proven insufficient. Traditional TPRM platforms, which have been used for over a decade, are primarily designed to handle structured data — data that is organized within standardized formats. In contrast, procurement often deals with unstructured data, such as contractual clauses and vendor correspondence, which does not follow a predefined format.

For example, during the initial assessment and ongoing diligence of third parties, organizations must manage a mix of information from spreadsheets, questionnaires, policies, and documents.

The need to manually handle data entry and integrate diverse data feeds from these various formats complicates the automation process, leading to bottlenecks.

In the absence of a better solution to managing increased workloads and static resources, many respondents said they would find other ways to manage their responsibilities. 63% of respondents said they would delay non-critical tasks when resources are limited. However, this strategy becomes problematic when all tasks are critical. Additionally, almost half (47%) would seek more resources or redistribute tasks among team members. Neither strategy is foolproof — new funding isn’t guaranteed, and shifting tasks risks overburdening teams and leading to burnout. These challenges highlight the struggles of effectively managing third-party risks without adequate budgets.

10

NAVIGATING THE CURRENT TPRM LANDSCAPE

Continual reliance on manual processes The survey highlights a significant reliance on manual processes across all parts of third-party management: 70% of respondents manually analyze thirdparty documents such as contracts and information security reports, while 63% translate changes in regulations and internal policies into actionable workflows.

Additionally, over half of the respondents (56%) manually conduct screening and due diligence for third parties, and the same percentage (56%) manually fill out questionnaires and assessments for compliance and risk management purposes.

Despite some standardization, such as Certificates of Insurance (COIs), System and Organization Controls Reports (SOC2), and ISO Certifications, the variability in policies and formats across third-party documents and specific company requirements are cited as reasons for continuing manual processes.

This is particularly true for analyzing contracts and assessments, which are labor-intensive due to their bespoke nature and the varying standards across companies. These documents, composed of unstructured data, normally require handson processing. Coupled with regulatory updates, they require repeated reviews to ensure compliance accuracy.

Experts point to other factors driving the persistence of manual processes in TPRM: diverse regulatory landscapes across jurisdictions, inconsistent processes within regions, and a cultural tendency among some management teams to equate extensive documentation with thoroughness, which is viewed as a protective measure against regulatory scrutiny.

Figure D: Which of the following areas are still largely manual at your organization?

(Select all that apply Analyzing third party documents, like contracts, information security reports, assessments, etc.

70% Translating changes in regulations / internal policies to workflows 63% Conducting screening and due diligence for third parties 56% Filling out questionnaires and assessments for compliance / risk management purposes 56% Other (please specify) 3% 11

THE BURDEN OF MANUAL TPRM WORKFLOWS

Manual data collection Page 13

Manual data validation Page 14

Policy and compliance interpretation Page 15

12 12

THE BURDEN OF MANUAL TPRM WORKFLOWS

Manual data collection A significant bottleneck is the resistance of suppliers to complete required questionnaires and assessments. This challenge is particularly acute for smaller suppliers who might not have dedicated teams available to handle inquiries in a timely and accurate manner.

When asked how much time a typical third party spends on answering questionnaires and assessments during their due diligence process, the median respondent reported spending 11-20 hours per month. When viewed at scale, the cumulative burden is significant.

For the median organization managing 501-1000 suppliers1, even at the low end of reported time, this amounts to at least 5,511 hours per month spent solely on due diligence questionnaires. This represents a significant strain — not just for thirdparty vendors who compile the necessary information but also for risk teams that must review and validate these responses.

The extensive time investment in conducting due diligence overwhelms third parties, inundating them with questionnaires

and assessments. This heavy workload leads to significant delays, particularly as functional owners struggle to provide timely responses. In some instances, as noted by one interviewee, these delays can extend up to 90 days or longer. Such delays slow down the onboarding process and negatively impact the accuracy and completeness of the information provided. These inefficiencies can prevent the timely prioritization of essential security measures.

The median organization spends 5,511 hours per month on due diligence questionnaires.

Figure E: How much time would you estimate a typical third party spends on answering questionnaires and assessments during your due diligence process? *Data may not add up to 100% due to rounding

Less than 10 hours per month 46% 11 - 20 hours per month 32% 21 - 30 hours per month 15% More than 30 hours per month 7% 13

THE BURDEN OF MANUAL TPRM WORKFLOWS

Manual data validation Manual data validation also poses challenges. Experts caution that the reported numbers in Figure E might underestimate the true effort involved, as third parties often submit incomplete or inconsistent information when answering questionnaires.

Such inconsistencies often trigger cycles of follow-ups and reassessments, disrupting workflows and extending the time needed for due diligence.

Additionally, many firms batch these tasks, dedicating several weeks to compliance assessments rather than spreading them evenly throughout the year. This concentrated, often annual, effort can be far more disruptive than maintaining a steady monthly workload.

Since third parties serve multiple clients and many provide multiple services — each with unique risk, compliance and performance requirements and document formats — the lack of standardized, shared documentation leads to repetitive work. Vendors must tailor their responses to each organization’s specific due diligence requirements, multiplying the effort needed.

14

THE BURDEN OF MANUAL TPRM WORKFLOWS

Policy and compliance interpretation analyzing third-party documents, including contracts, information security reports, and assessments. This highlights the significant workload associated with compliance interpretation, where teams must manually review and evaluate policies.

Another bottleneck in TPRM is the extensive time spent on policy and compliance interpretation. 41% of respondents reported spending more than 30 hours per month

One expert shared insights into the complexities faced by global firms, noting that regulatory inconsistencies across different regions lead to redundant efforts and a lack of standardized processes — often exacerbated by the manual nature of compliance tasks.

Figure F: Collectively, how much time is typically spent by members of your team? *Data may not add up to 100% due to rounding

51%

41%

32%

27%

18% 14% 11% 6% Less than 10 hours per month

10 - 20 hours per month

Updating workflows in accordance to changes in regulations or internal policy

21 - 30 hours per month

More than 30 hours per month

Analyzing third party documents, such as contracts, information security reports, assessments, etc.

15

THE ROLE OF GENAI IN TPRM

Automatically creating and updating workflows Page 17

Analyzing third-party documents Page 18

Automated filling of questionnaires and assessments Page 20

16 16

THE ROLE OF GENAI IN TPRM

Recognizing these challenges, innovations in GenAI help TPRM teams foster efficiency. Here’s how they offer support:

Automatically creating and updating workflows GenAI significantly streamlines the creation and updating of TPRM workflows, tasks that have traditionally been labor-intensive.

In conventional approaches, creating and updating TPRM workflows is a cumbersome process that requires extensive collaboration with IT, developers, or consultants. This multistep approach, from policy interpretation to process orchestration, often results in delays when responding to regulatory changes and best practice updates.

AI technologies like Certa AI streamline process management by directly translating policy updates into fully configured, actionable workflows. Users can input new policies in natural language, and the system automatically generates or updates workflows, ensuring timely compliance without the need for coding.

Survey data shows that the median organization typically spends 10-20 hours per month updating these workflows2.

With AI, this time is drastically reduced, freeing teams to focus on more strategic risk management instead of administrative tasks.

The median organization typically spends 10-20 hours per month updating TPRM workflows.

Policy Process Orchestration

Status Quo

Domain Expert

Regulation

Consultant/ Analyst

Policy

IT/System Admin

Technical Requirements

Domain Expert

Available Now

Regulation

Consultant/ Analyst

Policy

AI

Technical Requirements

Domain Expert

Regulation

Process Orchestration

No code tools

Process Orchestration

AI

Policy

The graph above demonstrates the steps that Certa AI can take.

Process Orchestration

17

THE ROLE OF GENAI IN TPRM

Analyzing third-party documents GenAI significantly reduces the time and complexity of analyzing critical thirdparty documents. Team members spend significant time analyzing documents like contracts, information security reports, and assessments. This manual process is prone to oversight and struggles with the complexity of unstructured data.

The median firm spends between 21 to 30 hours per month analyzing third-party documents.

Traditional systems, which are limited to structured data formats such as APIs, spreadsheets, and formulaic data sheets, fail to efficiently handle the variability and complexity of unstructured documents.

In contrast, GenAI technologies have the capability to interpret diverse documents, regardless of variations in order and format.

GenAI tools can initially screen these reports and flag what teams need to review manually, reducing the time assessors spend reviewing documents and allowing teams to focus on strategic risk management and compliance issues.

18

THE ROLE OF GENAI IN TPRM

How Certa AI can help: Continuously assess and correlate information, systems, and data Unlike traditional methods that don’t account for changes in third-party-provided documents, evidence, and other unstructured documents, Certa AI offers continuous assessment with real-time alerts. This proactive risk management ensures identifying potential threats early and validating data across various sources, including unstructured documents.

Automate remediation plans Traditional manual remediation is reactive and slow, risking prolonged disruptions or compliance failures. Certa AI automatically generates and manages remediation plans based on issues identified during the analysis of third-party documents, enhancing responsiveness and minimizing compliance risks before they escalate.

Instantly analyze third-party population contracts documentation, and corporate systems Traditional methods for analyzing third-party portfolios and related information are often slow and cumbersome, hindering responsiveness to new requirements. Certa AI rapidly assesses contracts and documentation, such as SOC2, against new requirements, proactively identifying compliance gaps and ensuring ongoing management to stay ahead of emerging risks.

Automatically Analyze, Enforce, and remediate KPIs/ SLAs Manual tracking of key performance indicators (KPIs) and service level agreements (SLAs) against business continuity and disaster recovery (BCDR) plans and performance tests can miss critical issues, risking disruptions and non-compliance. Certa AI automatically analyzes and enforces KPIs/SLAs, proactively correcting deviations to maintain service level compliance, ensure business continuity, and enhance operational efficiency. It also identifies areas for improvement in vendor performance, optimizing relationships and holding teams accountable.

19

THE ROLE OF GENAI IN TPRM

Automated filling of questionnaires and assessments Expanding the use of GenAI further, tools now also automate routine TPRM tasks. This includes the filling of due diligence questionnaires and assessments, significantly reducing the manual effort required and enhancing data accuracy.

How Certa AI can help: Streamlining due diligence with Certa AI: Data AI empowers vendors by reducing the time and effort to complete questionnaires.

Third-party stakeholders provide policies, certifications and other documents, and Certa AI automatically generates initial answers — reducing the manual input required.

Intelligent Pre-Fill automatically precompletes assessments using existing and historical evidence, freeing up valuable time for IT and information security teams.

Third Party Risk Management in action: Case Study Faced with lengthy onboarding times and inefficient vendor management, Quantcast, a leader in advertising technology, used Certa’s platform to revolutionize its processes. The implementation reduced onboarding times by threefold, achieving seven-day onboarding for high-risk vendors and five for low-risk ones. It also streamlined the management of over 200 contract renewals and facilitated more than 1,000 notifications across 300 vendors.

This allowed for more effective risk categorization and targeted mitigation strategies. Additionally, Certa AI’s tool freed up valuable resources, providing Quantcast with a comprehensive view of all vendor relationships and improving decision-making and operational efficiency.

20

CHALLENGES AND BARRIERS TO AI ADOPTION

Data security concerns Page 22

Resource and budget constraints Page 24

21 21

CHALLENGES AND BARRIERS TO AI ADOPTION

Data security concerns Data security is the primary concern for 60% of firms when adopting AI-driven solutions. The technology is still fairly new, and widespread perceptions of its potential risks exist, particularly following data breaches involving AI platforms. Additionally, there is a perceived lack of proven security, especially concerning the handling of sensitive information and third-party risks.

Figure G: What do you think are the biggest barriers to adopting such AI-driven solutions?

Concerns over data security 60% Cost of implementation 47% Lack of awareness of available solutions 37% Lack of skilled personnel to operate AI tools 34% Resistance to change within the organization 16% Other (please specify) 8%

OTHER: AI is not integrated into Risk framework and appetite Budget Constraints Concern with data accuracy from AI use Concerns about accuracy of results Lack of consistency in the offering, unproven track record, reliability of provider

One interviewee highlighted concerns over AI’s self-modifying capabilities and the potential unintended consequences of its use, which are poorly understood.

This predictability raises concerns about possible security vulnerabilities that AI might introduce.

Experts compared the transition to newer technologies like AI to earlier technologies such as cloud computing, which initially also caused widespread concern and confusion.

As organizations and regulatory bodies learn to ask the right questions about AI, they can better establish a foundational understanding to help mitigate these risks.

Concretely, regulatory bodies are beginning to draft AI rules. In 2024, the world’s first comprehensive AI law, the European Union’s AI Act, came into effect. The act mandates that companies dealing with AI must meet stringent requirements in risk management, data governance, information transparency, and human oversight3. Other jurisdictions, such as Singapore, have implemented regulatory frameworks, such as the Model AI Governance Framework for GenAI4.

As clearer regulations and standards are developed, many of the perceived barriers to AI adoption will likely diminish, enabling organizations to implement AI more securely.

Lack of knowledge to ensure AI tools are producing valid outcomes No proven need Not yet convoked there is a proper AI tool rather a lot of rebranding and usage of the letters from average vendors Resource to source, implement Unsure about potential value addition by AI 22

CHALLENGES AND BARRIERS TO AI ADOPTION

Certa’s Approach to responsible AI Certa AI is committed to developing and using AI responsibly, prioritizing fairness, transparency, and accountability. We uphold data privacy, mitigate bias, and maintain human oversight, aligning AI with ethical and legal standards. Our approach includes ethical impact assessments, user empowerment for data control, ongoing external engagement, and continuous evaluation. By ensuring safety, explainability, and inclusivity, we create AI solutions that benefit individuals, businesses, and society.

The Pillars of Responsible AI in Enterprise Great power

great responsibility

Fairness

Fairness Guard against biases in data

Inclusiveness

Inclusiveness Ensure that AI is accessible and sensitive to all populations

Reliability & Safety

Reliability Verify that results are accurate for the selected use case

Transparency

Transparency Information is from verifiable sources and auditable

Privacy & Security

Privacy & Safety Guarantee that data used during pre-empting or training can’t be leaked

Accountability

Accountability Legal, regulatory, compliance, along with fairness, safety

Microsoft

23

CHALLENGES AND BARRIERS TO AI ADOPTION

Resource and budget constraints 47% of respondents view the high costs of implementing AI-driven solutions as a significant barrier to adoption. When asked about the biggest challenges faced in managing third-party risks, 53% cite a lack of time and resources, and 50% struggle with inadequate technology and tools.

such as audit failures or control breakdowns, which could eventually lead to hefty regulatory fines or, paradoxically, require emergency budget increases to address regulatory pressures or operational failures.

While initial costs are a consideration, GenAIdriven tools offer a practical approach to streamlining TPRM — by automating routine tasks, helping organizations manage resources more efficiently, reducing the risk of costly errors, and improving compliance practices. With 37% of respondents citing a lack of awareness of available solutions and 34% a shortage of skilled personnel to operate AI tools, there’s a clear need to invest in training and development. Such initiatives would effectively equip teams to leverage GenAI, balancing its long-term value against upfront investment.

Budget limitations prevent organizations from acquiring essential resources, such as sophisticated tools and skilled personnel.

Experts noted that this often leads TPRM teams to devise creative but temporary solutions to cope with escalating demands.

While these stopgap measures may address immediate needs, they are unsustainable for long-term operational stability.

One expert predicted that budget constraints and inadequate resource allocation could lead to significant issues

Figure H: What are the biggest challenges you face in managing third party risks?

(Select all that apply) Lack of time / resources 53% Lack of appropriate technology / tools

Lack of understanding of this priority by Management 50%

Difficulty in coordination between departments

Complexity of regulations 37%

26% Other (please specify) 8%

Lack of up to date intelligence Low bargaining power

49%

Lack of expertise

OTHER: Historically, board acceptance and real support

Some regulatory bodies ask virtually the same thing, so you literally repeat the same thing for the next.

The constant changes in requirements impacting Third parties. Changes in risk requirements also impacts configuration on the TRPM tool that we use.

Transparency of functional vendor owners Unstructured data Validated financial information Vendors disclosing relevant details on their product/service 24

BENEFITS AND ROI

Efficiency and productivity gains Page 26

Better resource allocation Page 27

Enhancing strategic flexibility Page 28

25 25

BENEFITS AND ROI

Efficiency and productivity gains Users of AI-based solutions for TPRM report significant and measurable benefits. A substantial 39% of respondents reported a 21-30% improvement in efficiency from adopting AI, while another 26% noted an 1120% increase.

These efficiency gains are not just numbers; they translate into tangible benefits such as cost savings, more dynamic risk management strategies, and enhanced compliance. This demonstrates how AI can bolster operational capabilities by allowing teams to allocate their focus toward strategic activities rather than remaining bogged down in manual tasks.

Despite these gains, it’s noteworthy that 30% reported less than a 10% efficiency improvement. This modest increase points to a significant challenge: the lack of skilled personnel to effectively operate AI tools.

There is a clear need for well-designed training programs that help teams adapt to new technology, as well as an allocation for proper training and support to fully leverage AI’s capabilities. Additionally, choosing technology that is easy to use and has intuitive interfaces can make this transition smoother.

69% of firms using AI for TPRM have seen at least a 10% efficiency boost since adopting the technology

Figure I: What percentage improvement in efficiency have you seen as a result of AI adoption? *Data may not add up to 100% due to rounding

Less than 10% 30% 11 - 20% 26% 21 - 30% 39% 31 - 40% 4%

26

BENEFITS AND ROI

Better resource allocation With even a 10% increase in bandwidth, 66% of respondents indicated they would allocate the extra resources to focus on higher-level strategic initiatives. Additionally, 44% said they would conduct more in-depth due diligence on third parties, and 31% said they would improve the accuracy of due diligence assessments.

Figure J: If your team suddenly had 10% more bandwidth starting next week, how would you use the extra resources?

(Select all that apply) Focus on more high level, strategic initiatives 66% Conduct more in-depth due diligence on third parties 44% Improve accuracy of due diligence assessments 31% Insource initiatives currently completed by contractors

Expert opinions confirm that manual processes, such as vendor responses and documentation reviews, create significant bottlenecks. These inefficiencies highlight the need for a strategic shift from performing manual tasks to engaging in higher-level planning and decision-making. This shift significantly impacts the organization's direction and enhances overall efficiency.

One expert noted the current operational realities: due to pressing demands and an increase in workload without a corresponding increase in headcount, teams often must prioritize operational capacity over strategic planning. Although strategic initiatives are recognized for their value, immediate operational needs frequently take precedence.

GenAI-driven tools have the capacity to free up resources by automating repetitive tasks, enabling teams to concentrate on key operations, enhancing efficiency, and improving the overall agility and responsiveness of risk management functions — which ultimately benefit return on investment (ROI).

6% Other (please specify) 6%

OTHER: Complete more assurance work on Third party engagements.

Education and brainstorming Improved automation Maximize use of risk intelligence throughout the company Not needed Optimisation of processes

66% of respondents would use a 10% increase in bandwidth to focus on higher-level strategic initiatives.

Work less- still more than 40 hours a week but maybe not 60 27

BENEFITS AND ROI

Enhancing strategic flexibility Over the next 1-2 years, 62% of respondents are likely or very likely to implement more GenAI solutions, with only 15% indicating they are unlikely or very unlikely to adopt.

This indicates a clear interest in GenAI, recognizing its potential to enhance TPRM processes.

The enthusiasm for GenAI, while marked by gradual adoption rates, highlights a strategic shift towards more sophisticated, efficient systems. Most organizations are currently in exploratory phases, cautiously assessing the costs, security, and reliability to ensure that the technology aligns with their operational needs.

Experts suggest that the adoption of general tools akin to GenAI assistants, although still in the early stages, marks a shift towards automating more complex tasks — such as pre-populating questionnaires.

Within the next 1-2 years, 62% of respondents are likely to adopt more GenAI solutions.

This measured pace is part of a broader trend that has moved from understanding AI’s potential to actively implementing solutions that can drive significant gains in efficiency and strategic risk management.

The key factors influencing further adoption of GenAI include budget availability, organization ambition, confidence in the technology, senior management support, and appropriate guardrails for its strategic use.

Figure K: Q16. How likely are you to implement more GenAI solutions for TPRM in the next 1-2 years? *Data may not add up to 100% due to rounding

As GenAI technology becomes increasingly integral to operations and adoption grows, it is poised to transform risk management practices across industries.

Very likely 23% Likely 39% Unsure 23% Unlikely 8% Very unlikely 7% 28

FUTURE READINESS WITH GENAI

Conclusion Page 30

Executive summary: Certa’s reaction Page 31

29 29

FUTURE READINESS WITH GENAI

Conclusion Survey insights reveal a pressing need for better tools in TPRM, with GenAI set to optimize these processes. Amid budget constraints, the case for adopting AIdriven technologies becomes even more compelling as they create significant operational efficiencies and close productivity gaps. This extra bandwidth can allow firms to focus on higher-level strategic initiatives —precisely what the majority of respondents indicated they needed — which is critical for navigating the intricate dynamics of today’s global supply chains.

Contact Certa today to enhance your TPRM with the strategic benefits of GenAI.

30

FUTURE READINESS WITH GENAI

Executive summary: Certa’s reaction In today’s increasingly complex and tumultuous business environment, thirdparty risk management (TPRM) has become a first-tier priority for organizations worldwide. As global supply chains expand, businesses face mounting regulatory pressures and operational risks, despite contending with stagnant risk management budgets. The need for greater efficiency and productivity in TPRM has never been more urgent.

To bridge this gap, generative AI (GenAI) offers a transformative solution, enabling organizations to:

At Certa, we recognize that traditional, manual approaches to TPRM are no longer sustainable. Our research, in collaboration with CeFPro, reveals that 81% of firms have seen an increase in third-party relationships over the last three years, yet 40% report stagnant or reduced budgets. Manual workflows remain a significant bottleneck, with 70% of organizations still relying on labor-intensive processes for document analysis and 56% conducting manual due diligence. The result is a productivity gap that threatens organizations’ ability to manage risk effectively.

68% of risk professionals are looking to implement automation tools, showing that the industry recognizes the need to close the productivity gap. However, traditional IT falls short when it comes to automating risk teams’ manual processes. Previous solutions were built to analyze structured data, like spreadsheets and databases, and not the unstructured data, like contracts, assessments, and compliance reports, that risk teams work with heavily in their day-today.

Jag Lamba CEO & founder Certa

•

Automate and streamline workflows by instantly translating regulatory changes into actionable processes.

•

Analyze third-party documents with AI-powered insights, reducing manual review time.

•

Pre-fill due diligence assessments to ease the burden on vendors and internal teams.

The results speak for themselves.

Organizations that have adopted AI-driven TPRM solutions report median efficiency gains of 21-30%, and 66% of respondents indicate that they’d use efficiency gains to focus on more high-level, strategic initiatives, which are crucial to the long-term success of a business.

Barriers to AI adoption persist, with 60% of firms citing data security concerns and 47% pointing to implementation costs.

Despite these challenges, 62% of firms plan to expand their use of GenAI in TPRM within the next two years, recognizing that the ability to automate, analyze, and innovate will define the future of risk management.

Looking ahead, AI-driven TPRM will no longer be a competitive advantage—it will be a necessity.

At Certa, we are committed to empowering organizations with cutting-edge AI solutions that simplify workflows, automate processes, and deliver full visibility. Designed to be modular and flexible, Certa scales as your business grows and adapts effortlessly to evolving regulations. Contact us today to explore how AI-driven TPRM can drive measurable value for your business.

31

ADDITIONAL DATA

Additional questions from survey Page 33

Appendix Page 33

32 32

ADDITIONAL DATA

Additional questions from survey

Figure L: How many third-party relationships does your organization currently have?

*Data may not add up to 100% due to rounding

13%

10%

13%

17%

47%

Fewer than 50

50 - 100

101 - 500

501 - 1,000

More than 1,000

Appendix 1 see Figure L 2 see Figure F 3 https://www.europarl.europa.eu/topics/en/article/20230601STO93804/eu-ai-act-first-

regulation-on-artificial-intelligence

4 https://aiverifyfoundation.sg/wp-content/uploads/2024/05/Model-AI-Governance-

Framework-for-Generative-AI-May-2024-1-1.pdf

33

© Copyright Center for Financial Professionals Limited, CeFPro®, 2025. All Rights Reserved.

No part of The State of Financial Reporting in Banking publication, or other material associated with CeFPro®, may be reproduced, adapted, stored in a retrieval system or transmitted in any form by any means, electronic, mechanical, photocopying, recording or otherwise, without the prior permission of Center for Financial Professionals Limited, or as trading as the Center for Financial Professionals or CeFPro®.

The facts of the The State of Financial Reporting in Banking are believed to be correct at the time of publication but cannot be guaranteed. Please note that the findings, conclusions and recommendations that CeFPro® delivers will be based on information gathered in good faith, whose accuracy we cannot guarantee.

CeFPro® acknowledges the guidance and input from the Advisory Board, though all views expressed are those of the Center for Financial Professionals, and CeFPro® accepts no liability whatever for actions taken based on any information that may subsequently prove to be incorrect or errors in our analysis. For further information, contact CeFPro®.

CeFPro®, Fintech Leaders™ and Non-Financial Risk Leaders™ are either Registered or Trade Marks of the Center for Financial Professionals Limited.Unauthorized use of the Center for Financial Professionals Limited, or CeFPro®, name and trademarks is strictly prohibited and subject to legal penalties.

34

www.cefpro.com