Re-engineering supply chain risk management: From compliance engine to risk-adaptive control

Most organisations have invested heavily in supply chain risk management. However, many programs operate like a compliance engine, with cadence-driven reviews, questionnaire-heavy workflows, and "green" status that can mask service-level exposure. A familiar pattern follows: the SOC 2 report looks fine, the TPRM team are content, but cyber teams discover significant issues once integrations and access paths are examined. 

Drawing on leading practices by Australian, UK and US organisations, this session will expose three shifts that move programs from periodic assurance to risk-adaptive control. Attendees will leave with practical ways to apply these shifts: what signals to watch between reviews, how to build cumulative supplier insight across functions, and how to bring ecosystem and concentration awareness into day-to-day risk decisions.

Why Traditional Models Break Down

Traditional supply chain risk models assume risk can be understood at defined points in time – and from what the supplier tells you. In practice, risk shifts between reviews: access expands as services bed down, integrations deepen, suppliers introduce new subcontractors and shared platforms, and cyber posture can deteriorate materially. Meanwhile, reliance and concentration increase across a small number of critical providers. The result is a widening gap between assurance outputs and operational reality - assessments can pass while material exposure builds in the background. 

The Re-Engineering: Three Shifts That Matter

• Shift from cadence-driven assurance to change-led intervention.​Formal review cycles remain (often for regulatory defensibility), but action is no longer dictated by the calendar. Defined signals indicate meaningful change between reviews, enabling a tiered signal to action response and targeted out of cycle engagement rather than defaulting to full reassessment. The challenge is separating signal from noise and having a graduated set of intervention options once a signal is detected.
• Shift from one off reassessments to cumulative risk insight.​Rather than treating each reassessment as a fresh exercise, assurance becomes cumulative. Prior assessments, unresolved findings, remediation outcomes, incidents, monitoring context and lifecycle changes are deliberately carried forward into decisions. This requires cyber, technology, risk, legal and procurement teams to cross inform each other, recognising no single view is complete. The objective is a shared, evolving understanding that supports sharper, proportionate engagement. 
• Shift from a supplier centric view to ecosystem and concentration awareness.​Bilateral assessments miss where exposure often sits: in shared platforms, downstream dependencies and concentration across providers. These risks lie beyond the direct contract and may only become visible as services evolve or even fail. The conversation shifts from "is this supplier compliant?" to "how does this ecosystem behave under stress?", grounding engagement with suppliers in realistic service level risk and business impact.

This practitioner-focused session invites attendees to honestly assess whether their supplier risk programs prove compliance or truly move the needle on risk. I will show how to detect change that questionnaires miss (including cyber posture drift), separate signal from noise, and take the next best action between cycles, backed by cumulative insight shared across cyber, risk, legal, procurement and technology.