Day Two | November 11
Here is the latest edition of the agenda. As we approach the event, we will be adding speakers and sessions to enhance your experience. To stay informed, please register your interest
8:00
Breakfast and Networking
8:50
Chair’s Opening Remarks
Tower Suite 3-Operational Risk & Resilience
Tower Suite 1-Innovation & Automation
9:00
Critical Third Parties: Operating Under Dependency and Power Imbalance – PANEL DISCUSSION
Managing third-party risk where control is limited, leverage is low, and vendors dictate terms
Key topics
- Operating effectively within “take-it-or-leave-it” contracts and limited audit rights
- Managing risk where access, transparency, and control are restricted
- Defining escalation strategies when critical vendors underperform
- Using collective pressure, industry forums, and regulatory leverage to influence outcomes
 | Lisa Migheli,Head of Third Party Risk,MUFG |
 | Anne McGowan,Head of Supplier Management,Lloyds Banking Group |
9:00
WHEN RISK EVOLVES, AGILITY WINS: HOW AI IS TRANSFORMING THIRD-PARTY RISK MANAGEMENT – PRESENTATION
As third-party ecosystems become more interconnected, TPRM programmes must respond to an expanding range of operational, cyber, regulatory, ethical, and sustainability risks.
This session explores how an agile, human-centred platform with embedded AI can provide a continuous, 360-degree view of third-party risk, enabling teams to reduce manual effort, accelerate analysis, and make more informed, proactive decisions.
This session explores how an agile, human-centred platform with embedded AI can provide a continuous, 360-degree view of third-party risk, enabling teams to reduce manual effort, accelerate analysis, and make more informed, proactive decisions.
Key topics
- Building an agile TPRM programme that can adapt to emerging risks and changing business requirements
- Creating a continuous, comprehensive view of risk across interconnected third-party ecosystems
- Using embedded AI to accelerate risk analysis, identify emerging issues, and support earlier intervention
- Reducing manual processes while maintaining effective human oversight and informed decision-making
- Strengthening operational resilience, regulatory compliance, IT security, ethical practices, and sustainability through integrated risk intelligence
 | Adelani Adesida,Managing Director, Europe,Aravo |
9:45-10:20
Embedding Resilience into Supplier Contracts and Governance – Presentation
Embedding resilience into supplier contracts and governance frameworks to ensure enforceable standards and real-world outcomes
Key topics
- Defining clear resilience expectations, responsibilities, and accountability within supplier agreements
- Aligning contractual obligations with operational resilience and regulatory requirements
- Embedding performance, recovery, and service continuity standards into contracts
- Strengthening governance across the contract lifecycle, from onboarding to exit
 | Neil Stevenson,Head of Supplier & Contract Management,Aegon |
9:45-10:35
Transforming Due Diligence Through Automation and AI
Replacing fragmented TPRM tools with a connected ecosystem that enables real-time visibility, control, and better decision-making
Key topics
- Integrating platforms, data, and workflows across onboarding, monitoring, and incident management
- Eliminating duplication and manual effort through automation and system interoperability
- Establishing a single source of truth for third-party risk data across the enterprise
- Balancing usability with governance, control, and audit requirements
- Designing an architecture that supports continuous monitoring, AI adoption, and evolving regulatory expectations
 | Senior Expert, Gatekeeper, |
10:40
Morning Refreshment Break and Networking
10:40
11:10
Why Regulatory Readiness Will Not Save You When the Third Party Fails – PRESENTATION
Demonstrating effective third-party risk management through clear, defensible evidence aligned with regulatory expectations
Key topics
- Documenting risk decisions, actions, and outcomes in a consistent and auditable way
- Aligning evidence and reporting with evolving regulatory and supervisory expectations
- Strengthening transparency across governance, controls, and oversight
- Reducing duplication and manual effort in evidence collection and validation
 | Sajid Iqbal,Head of Financial Risks & ICAAP,Habib Bank AG Zurich, UAE |
11:10
ZERO TRUST ACROSS THE THIRD-PARTY ECOSYSTEM: MOVING FROM PERIODIC ASSESSMENTS TO CONTINUOUS ASSURANCE
As organisations become increasingly dependent on cloud providers, software suppliers, subcontractors and fourth-to-nth parties, traditional perimeter-based security is no longer sufficient. This session will explore how Zero Trust principles can strengthen third-party and supply-chain risk management by replacing implicit trust and point-in-time assessments with continuous, evidence-based verification..
Key topics
- Applying “never trust, always verify” across complex third-party ecosystems
- Moving beyond annual questionnaires and certifications towards continuous assurance
- Aligning the eight domains of the IEEE Zero Trust Security Framework with third-party risk controls
- Addressing concentration risk, fourth-party dependencies and operational resilience
- Using a technology-neutral Zero Trust framework to support regulatory compliance and alignment across industry standards
 | Dr Jayne Suess,Consultant,Independent Consultant |
11:45
Reputational Risk: When Third-Party Failure Becomes a Public Crisis – – PANEL DISCUSSION
Using real third-party failures to challenge existing frameworks, expose control weaknesses, and drive meaningful change
Key topics
- Identifying root causes beyond surface-level failures, including control, governance, and dependency gaps
- Pinpointing where risk identification, escalation, and response mechanisms broke down
- Assessing the effectiveness of crisis management, communication, and decision-making under pressure
- Embedding lessons learned into frameworks, controls, and scenario testing
- Moving from reactive fixes to forward-looking resilience strategies
 | Justin Jefferys,Head of Media Relations,ITV |
 | Alison Flynn,Global Head of Corporate Affairs,Impla Terminals |
11:45
Balancing Automation and Human Oversight: Defining Decision Ownership in TPRM – PANEL
Defining decision ownership in AI-enabled environments where accountability, judgement, and control cannot be automated
Key topics
- Establishing clear ownership of decisions across automated and human-led processes
- Managing conflicts between model outputs and expert judgement
- Determining when and how human intervention should override automated decisions
- Embedding accountability and auditability into decision-making frameworks
 | Rachael Elliot,Director of Global Strategy & Innovation,DRI International (Disaster Recovery Institute) |
 | Samikendra Ghosh,Global Head of Third Party Risk Management,Howdens |
12:10
Operationalising Scenario Testing: Strengthening Preparedness Across Third Parties
Designing and executing realistic disruption scenarios to strengthen response and recovery capability across third parties.
Key topics
- Designing realistic multi-party disruption scenarios
- Testing supplier and internal response capabilities under stress
- Identifying gaps in contingency and recovery planning
- Translating outputs into actionable improvements
 | Patrycja Lakomiak,Head of Enterprise Risk Management, Global Supply & Quality,Takeda Pharmaceuticals International AG |
9:55
AI-Enabled Third Parties: Managing Supplier Exposure and Dependency Risk – Presentation
Understanding the operational and strategic risks created by suppliers using AI where visibility, influence, and control are limited
Key topics
- Assessing how suppliers are deploying AI across products, services, and operations
- Managing dependency risk linked to critical AI-enabled vendors and platforms
- Addressing visibility gaps across supplier AI usage and external data sources
- Defining due diligence approaches for AI-enabled suppliers
- Evaluating the business impact of supplier-driven AI failures or disruption
 | Mihaela Breg,Head of Operational Resilience & Business Transformation,Europe Arab Bank |
Tower Suite 2 -Regulation & Standards
9:55
Managing Data Risk Across Third Parties: Strengthening Protection Without Limiting Access – Presentation
As organisations become increasingly dependent on external providers for data processing, storage and analytics, protecting critical information has become both a compliance and resilience challenge
Key topics
- Managing risks associated with data sharing, access and outsourcing arrangements
- Monitoring how third parties store, process and transfer sensitive information
- Addressing data concentration, sovereignty and cross-border transfer risks
- Embedding privacy and protection requirements into third-party oversight frameworks
- Managing emerging challenges created by AI, data aggregation and interconnected ecosystems
 | Andrew Mohammed,Director of Data and AI,OVO |
12:30-1:30
LUNCH NETWORKING
All attendees have access to:
- Extended networking lunch
- Meetings with peers, speakers and sponsors
- Networking lounge and exhibition area
Roundtables are optional, limited to 30 attendees per table, and require advance registration. Attendees not participating in a roundtable may continue networking until sessions resume
12:30-1:30
LUNCH NETWORKING AND OPTIONAL ROUNDTABLES
All attendees have access to:
- Limited to 30 attendees per table
- Interactive peer-to-peer discussion format
Roundtables are optional, limited to 30 attendees per table, and require advance registration. Attendees not participating in a roundtable may continue networking until sessions resume
ROUNDTABLE
Reputational Risk in TPRM
 | Justin Jefferys,Head of Media Relations,ITV |
ROUNDTABLE
Leading Through Third-Party Disruption: Aligning the Business Before a Crisis Happens –
| Alison Flynn,Global Head of Corporate Affairs,Impla Terminals |
ROUNDTABLE
The Future TPRM Operating Model
| Rachael Elliot,Director of Global Strategy & Innovation,DRI International (Disaster Recovery Institute) |
ROUNDTABLE
Geopolitical Risk and the Supply Chain
| Patrycja Lakomiak,Global Supply & Quality Head of Enterprise Risk Management,Takeda Pharmaceuticals International AG |
ROUNDTABLE
AI Governance Beyond Compliance
 | Mihaela Breg,Head of Operational Resilience & Business Transformation,Europe Arab Bank |
1:30
Managing Risk Across Global Supply Chains and Improving Visibility – PRESENTATION
Managing third-party risk across complex global supply chains without compromising speed, efficiency, or operational continuity
Key topics
- Moving from static recovery plans to adaptive, real-time response strategies
- Managing risk across geographically dispersed and interdependent suppliers
- Responding to geopolitical, environmental, and systemic disruption
- Improving end-to-end visibility across multi-tier supply chains
- Aligning supply chain strategy with resilience and continuity objectives
 | Hanna Pradera,Global Director, Procurement,Trinseo |
1:30
AI Governance in Third-Party Risk Management – PRESENTATION
Establishing governance frameworks to ensure AI-driven TPRM is transparent, accountable, and aligned with regulatory expectations
Key topics
- Defining accountability for AI-enabled decision-making across the third-party lifecycle
- Ensuring transparency, explainability, and auditability of AI models
- Aligning AI governance with regulatory and supervisory expectations
- Embedding AI oversight into enterprise risk and control frameworks
- Managing model governance, validation, and assurance processes
| Charles Forde,Independent |
2:05
Future of Regulation and Preparing for What’s Next – PRESENTATION
Regulatory expectations are likely to evolve – but how can organisations prepare?
Key topics
- Anticipating expansion of regulatory scope across industries
- Preparing for increased scrutiny of third-party ecosystems
- Aligning long-term strategies with regulatory trends
- Building adaptable and forward-looking compliance frameworks
 | Teresa Burton,Supplier Risk Manager,CRC Group |
2:05
Assurance Over Third-Party Risk – Who Verifies the Verifiers?
As third-party risk programmes mature, organisations are increasingly challenged to demonstrate independent assurance over their controls and decision-making.
Key topics
- Aligning first, second and third lines of defence
- Testing the effectiveness of TPRM controls and frameworks
- Preparing for regulatory reviews and internal audit scrutiny
- Using assurance findings to drive programme improvement
- Demonstrating that risk decisions are being consistently applied
 | Vassiliki Ntoupi,Senior Director, Outsourcing Officer,Piraeus Bank |
2:40
Afternoon Refreshment Break & Networking
2:40
3:10
PLENARY : Risk Is Now Systemic — Are Organisations Built for It?
Organisations must rethink how they manage interconnected third-party ecosystems as systemic risk, critical dependencies, and shared infrastructure create exposure beyond traditional supplier oversight
Key topics
- Understanding how systemic risk is reshaping third-party oversight
- Why concentration and dependency risk are becoming enterprise-wide challenges
- Moving beyond siloed ownership of resilience, cyber, procurement, and operations
- Building organisations capable of withstanding cascading disruption across ecosystems
- Redefining resilience for a world of interconnected risk
 | Lucy da Piedade, Managing Director, Head of the Group Controls Office,Deutsche Bank |
 | Dr Luke Bellamy,Lead Engineer for Industrial Resilience, CTO Team, WMG,University of Warwick |
 | Lisa Brady,Head of Vendor Risk Management,Jefferies |
3:55
PLENARY : What Comes Next: The Future of Third-Party Risk in a Hyper-Connected World
Emerging risks across AI, cyber, geopolitics, and regulation are reshaping how organisations must approach third-party risk
Key topics
- How AI and automation will redefine third-party ecosystems
- The rise of systemic and cross-industry risk exposure
- Preparing for risks that cannot yet be fully quantified
- What organisations need to build now to remain resilient in the future
 | (Moderator) Andreas Simou,Managing Director,CeFPro |
 | Julie Gaiaschi, CEO & Co-Founder,Third Party Risk Association (TPRA) |
 | Anita Barber,Head of Third Party Management and Operational Integrity and Resilience,Lloyds Banking Group |
4:35
Closing Remark’s and End of Vendor and Third Party Risk Cross Industry