30.06.2026

|

Bruno Blumenthal

|

Presentation

TPRM: From a Graveyard of Spreadsheets to Targeted Management

Teaser Image

Abstract

Many companies are drowning in a flood of administrative tasks related to third-party risk management (TPRM): Extensive standardized questionnaires for every service provider lead to outright compliance fatigue, while critical supply chain risks often go undetected. At ISSX, Bruno Blumenthal drew on practical experience to demonstrate how to move away from a one-size-fits-all approach.

Drawing on insights from various implementation projects, he illustrated proven approaches for three core elements of risk-based TPRM:

  • The triage logic: How service providers can be precisely classified according to their risk potential with minimal effort, based on company and service characteristics.
  • Question Tailoring: Why a reduced number of questions often leads to higher data quality, and how controls are specifically assigned to the respective risk profile.
  • Risk-Based Monitoring: How necessary monitoring measures can be consistently derived from the risk profile, rather than assessing every partner according to the same rigid scheme.

Based on this blueprint, a lean TPRM can be established that can be implemented using simple means. The clear goal: to shift the focus from mere data collection to effective risk reduction.

Translated with DeepL.com (free version)

Presentation

About the speaker

Bruno Blumenthal
Bruno Blumenthal
Partner, Member of the Executive Board
Dipl. Ing. FH Computer Science
CISM, CISA, CISSP

I have been involved in information and cyber security for over 20 years. I support our clients in the further development and optimization of their security governance and organization. When building future-proof security architectures, I focus on the optimal interaction between technology and people. I am also involved in further training in the field of cybersecurity as chief expert for the Information Security Manager examination with a federal diploma.

vCard Linkedin

Further publications

To all contributions