The risk you haven’t connected yet.

The Risk You Haven’t Connected Yet is a white paper on third-party risk management (TPRM) in the age of AI by Nicky Downing, Founder and CEO of Guideline BizTech and creator of RUBIQ, developed from themes presented at the TCI Future of Third-Party Risk Conference 2026 in Johannesburg. Its argument in one sentence: the next era of TPRM will be won by organisations that can see change across their ecosystem, connect that change to business consequences, and create accountable action before the risk becomes an event.

The problem it names

Third-party risk has long been organised around one question: do we know enough about the supplier in front of us to do business with them? The paper argues that question no longer suffices. Organisations depend on networks of suppliers, platforms, data processors, cloud providers, payment rails, subcontractors, beneficial owners and, increasingly, AI model providers. The risk sits in the relationships between them.

Its central claim is that much of what teams experience as third-party “uncertainty” is an information deficit. The paper names five gaps:

1. The collection gap. Ownership, financial, cyber, resilience or subcontractor information was never gathered.
2. The connection gap. Screening results, contracts, incidents and registers live in different systems, so their combined consequence is invisible.
3. The impact gap. A red flag exists, with no link to the critical services, customers or controls it affects.
4. The change gap. The assessment was right six months ago; the facts underneath it have moved.
5. The governance gap. Alerts accumulate with no owner, decision, SLA or evidence of closure.

Concentration hides behind procurement diversity

Ten vendors can look diversified while all ten rely on the same cloud provider, identity platform, payment processor or AI foundation model. The paper makes the relationship, not the vendor, the unit of analysis, and builds the case for Nth-party dependency mapping on the Financial Stability Board’s third-party toolkit and the IMF’s work on concentration around frontier AI and critical cloud services.

AI cuts both ways here. Entity resolution, graph analytics and continuous monitoring can surface shared dependencies a vendor register never shows. AI services are also new Nth parties in their own right, assembled from foundation models, GPU infrastructure, datasets, open-source libraries and plug-ins. The paper maps eight risks AI introduces or amplifies, from prompt injection and model drift to shadow AI and synthetic fraud.

From annual questionnaires to change-to-risk management

Annual reassessment assumes a supplier’s risk state holds still between review dates. The paper proposes a change-to-risk layer instead: sense the signal, resolve which entity it concerns, connect it through the relationship graph to services, data, customers and controls, interpret its materiality, put the decision to an accountable person, act through workflow, and prove it in the audit trail. The aim is fewer, more material alerts, each tied to a consequence and an owner.

Ten design principles keep AI inside that loop accountable, among them privacy by design, AI segregation of duties, evidence as a design object, and a resilient fallback for when automation is unavailable.

The South African context

For local risk leaders the paper reads the direction of travel: the Prudential Authority’s supervisory focus on third-party risk and strategic partnerships, operational-resilience requirements for banks, and POPIA’s rule that a responsible party stays accountable for the operators that process personal information on its behalf. Outsourcing an activity does not outsource accountability.

Twenty questions for the board

The paper closes with a 20-question executive checklist, alongside nine measures boards can track instead of questionnaire completion, from signal-to-action time to exit readiness. Three of the questions, as a taste:

• Can we see concentration where multiple suppliers depend on the same cloud, platform, data, logistics, payment or AI provider?
• Which decisions are prohibited from autonomous AI approval?
• If a major supplier failed tomorrow, could we immediately answer: what does it affect, who owns the response, and what do we do next?