Managing Emerging Third-Party Risks with ERM and Control Automation
Key Takeaways:
- Third-Party Risks Are Growing: Vendor weaknesses can expose sensitive data, disrupt operations, and threaten business continuity.
- Automation Strengthens Oversight: Automated controls improve monitoring, detect issues sooner, and reduce manual work.
- Automation Requires Human Oversight: Poor data quality, configuration issues, and inadequate testing can create control gaps and false assurance.
- Integrate Controls with ERM: Strong governance, clear ownership, and internal audit help organizations monitor third-party risks and respond to emerging threats.
As organizations rely more on third-party vendors, service providers, and technology platforms, third-party risk has become central to enterprise risk management (ERM). These relationships support essential functions, such as payroll, financial systems, cloud hosting, cybersecurity, and customer service, so a third-party weakness can quickly affect the organization. Because third parties may access sensitive systems, process confidential information, or perform activities affecting financial reporting, organizations need clear visibility into vendor dependencies and monitoring. Controls help by testing the processes, systems, and information flows supporting financial reporting and revealing broader weaknesses. Connecting the controls with ERM gives leadership a more complete, timely view of risk.
Automation can strengthen this connection by improving the speed, consistency, and visibility of controls, but it does not eliminate the need for strong third-party oversight. Automated controls are effective only when organizations understand which vendors influence key processes, what data they use, how system changes are managed, and who reviews exceptions. Automation’s value depends on effective governance, reliable data, clear ownership, and human oversight. Understanding its benefits and limitations is essential to making control automation a meaningful part of ERM and a practical tool for managing third-party risk.
Third-Party Risk: The Weakest Link
Third-party and supply chain risks affect nearly every business. Companies rely on providers, such as payroll processors, cloud platforms, accounting software, and enterprise resource planning systems, for essential functions. These services improve efficiency but create risks outside the organization’s control. The Institute of Internal Auditors (IIA) reported that 30% of recent data breaches involved a third party, twice the prior year’s percentage. A failure at one critical vendor can expose sensitive data, disrupt operations, and damage customer trust.
Technology and supply chains add exposure. Aging systems may require costly upgrades, create compatibility issues, or lose vendor support. CISA warns that unsupported software can reduce performance and productivity while leaving vulnerabilities unpatched and recommends retiring end-of-life products. Severe weather, vendor failures, and poorly structured contracts can interrupt operations or leave companies with unusable inventory. These risks do not mean third-party relationships should be avoided; companies should vet vendors, set clear contract terms, monitor performance, protect information access, and maintain contingency and incident response plans.
Automated Controls: Strengths and Shortfalls
Strong governance, internal controls, and ERM help companies identify and respond to third-party risks. Control automation supports these efforts by reducing manual work, improving oversight, and detecting issues sooner. Continuous controls monitoring enables more frequent testing and gives compliance professionals more time for higher-risk areas requiring judgment.
Still, automation creates risks when not properly designed, implemented, tested, or monitored. Poorly configured controls may apply wrong business rules, miss key transactions, or overlook exceptions. Gaps can go unnoticed when users assume an automated process is operating correctly. Software updates, evolving processes, and poor data quality can weaken controls or produce misleading results. Incomplete, inaccurate, or incorrectly mapped source data may make controls appear effective while producing unreliable evidence. This false assurance can delay management, compliance, and internal audit responses to emerging risks.
For these reasons, automation should enhance rather than replace human judgment and oversight. Clear ownership, access controls, change-management procedures, regular testing, and exception review are necessary to confirm that automated controls continue working as intended as systems and operations change.
Smart Automation, Strong Governance, Effective ERM
Third-party risk is increasingly central to ERM. In a survey of risk leaders at St. John’s University’s 2022 ERM Summit, more than 90% said third-party risks had increased and over 60% considered them more important than other organizational risks.
Control automation supports ERM by improving how organizations identify, monitor, and respond to financial-reporting and compliance risks. Automated tools can monitor transactions, flag unusual activity, track control performance, and document testing evidence.
To realize these benefits, organizations must include automation-related risks in ERM. Poor design, inaccurate data, unauthorized changes, and overreliance on automated results can create hidden control gaps. Internal audit can evaluate governance, control ownership, vendor oversight, and monitoring and recommend improvements to policies, access controls, and change management. When properly governed, control automation connects compliance with broader risk management, improving leadership visibility and helping the business respond to emerging risks sooner.
Final Thoughts
Third-party risk cannot be managed through isolated compliance activities or technology alone. Organizations need an integrated approach using controls to validate critical processes, automation to improve monitoring, and ERM to connect control results with broader business risks. Combining strong governance, reliable data, and informed human judgment strengthens third-party oversight and responses to risks threatening financial reporting, operations, and long-term resilience.
To learn more about McKonly & Asbury’s Internal Audit services, contact Partner Dave Hammarberg or Senior Manager Victor Kong, who have been providing internal audit and forensic accounting services for over twenty years. We would love to discuss how we can assist you with your challenges.
About the Author
Hunter Ridge joined McKonly and Asbury in 2026 and is an Advisory Senior with the firm. He is a member of the firm’s Advisory & Business Consulting Segment, as well as a member of our Internal Audit team.
