Day One | October 14
Here is the latest edition of the agenda. As we approach the event, we will be adding speakers and sessions to enhance your experience. To stay informed, please register your interest
Key topics
- The realities TPRM programs are dealing with now, including regulatory expectations, operational disruption, vendor AI adoption, and growing dependency on a small set of critical providers
- How these forces are beginning to change due diligence, ongoing monitoring, resilience planning, and what “good” governance looks like in practice
- What this means for the profession over the next few years, including emerging skill sets, closer collaboration with other risk and business functions, and new ways of showing value to leadership
 |
Nathan Rodgers,Executive Director,JPMorganChase |
 |
Moderator: Ed Thomas,Senior VP of Marketing and Sales Operations,ProcessUnity |
 |
Malcolm Smith,VP, Global Lead of TPRM Office,Goldman Sachs |
 |
Shankar Krishnan,Managing Director,PromptArmor |
This panel brings together practitioners to share how they are preparing for, managing, and learning from third-party cyber incidents and operational disruptions. Panelists will discuss real coordination challenges across vendors, legal, security, communications, and executive leadership, and how they are improving visibility into fourth-party dependencies and AI related threats.
Key topics
- Ways to integrate critical third-party dependencies into resilience planning, testing, and impact analysis
- Practical approaches for coordinating incident response across vendors, legal, security, communications, and executives
- Techniques for improving visibility and decision-making around fourth-party dependencies and AI-related threats
|
(Moderator) Shankar Krishnan,Managing Director,PromptArmor |
 |
Kayla Davis,VP, Enterprise Vendor Management Office,Keesler Federal Credit Union |
 |
Hannah Moore,Third Party Risk Senior Regional Lead-Americas,Wise |
 |
Daniel Heid,Managing Director, Head of Third Party Risk,Charles Schwab |
 |
Pete Savin,Director of Risk Products Sales Engineering,BlueVoyant |
 |
Max Yang,Director,PromptArmor |
 |
Ric Lewis,Account Executive,iCOUNTER |
 |
Karen Slater,Account Executive,Hyperproof |
Key topics
- Practical examples of operational risk outputs that directly informed vendor or control decisions
- Ways to adjust governance, reporting, and communication so operational risk information is easier to use
- Initial changes teams have made to move beyond a compliance orientation without rebuilding their entire program
 |
Tiona Smith,Director,Ally |
Key topics
- How recent cyber events have exposed limits in traditional third-party assurance
- Additional techniques and data sources that give a more current view of vendor cyber posture
- Examples of updated due diligence practices that improved efficiency, confidence and resilience
 |
Ryan Patrick,EVP, TPRM Customer Solutions,HITRUST |
Compliance work is often invisible. Nobody notices the checks, the chasing or the paperwork until a regulator or an audit lands and finds a gap. For third-party risk and procurement teams working under real regulatory scrutiny, that invisible admin keeps growing: more vendors, more oversight, and rarely any extra headcount to match it.
In this session, Matt Langlois sits down with Tim Harvey, Procurement Manager at CompSource Mutual Insurance, for a practitioner’s view of what it actually takes to keep third-party compliance visible and defensible under regulatory pressure.
Key topics
- The judgement calls that mattered most, and what changed in how Tims team thinks about “audit ready”
- What happens when AI agents start doing some of this work
- Where automation earns its place, and why a record of what was decided, and why, matters as much as the decision itself.
 |
(Moderator) Matthew Langlois,VCLM Advisor,Gatekeeper |
 |
Tim Harvey,Procurement Director,CompSource Mutual Insurance Company |
Key topics
- How to assess vendor cyber resilience beyond simple questionnaire responses, including concentration and fourth-party dependencies
- Ways to connect security monitoring, incident management, and TPRM workflows so responses to disruptive events are faster and more coordinated
- Approaches for explaining third-party cyber exposure and major outage scenarios in business terms that operational risk, resilience teams, and senior leaders can act on
 |
Evan Tegethoff,VP Solution Engineering,Bitsight |
 |
Emma Stevens,Senior Threat Intelligence Advisor,Bitsight |
Key topics
- How AI-driven services create layered “risk behind the vendor” that affects cyber, operational resilience, data protection, compliance, and strategy
- Why traditional due diligence, contracts, and monitoring are struggling to keep pace with opaque and fast-changing AI supply chains
- Big-picture ideas for how organizations can rethink TPRM, governance, and collaboration so they are better prepared for AI-enabled ecosystems across all business areas
 |
Johnathan Bald,SVP Global Sales Lead,Black Kite |
Key topics
- Build trust through business context: Understand the business need, the stakeholder landscape, and the risk.
- See the relationship, not just the vendor: Identify the actual exposure: what the vendor supports, what they can access, and where human ownership sits.
- Orchestrate the risk decision: Bring the right stakeholders, findings, and controls together so risks lead to informed business decisions and action.
- Create lasting accountability: Replace one-time risk ratings with defined risk owners, clear decision authority, and expiration dates.
 |
Ritika Patel,Third Party Risk Program Manager,Coreweave |
- Extended networking lunch
- Meetings with peers, speakers and sponsors
- Networking lounge and exhibition area
- Limited to 30 attendees per room
- Advance sign-up required
- Interactive peer-to-peer discussion format
Magnolia 1–2
TPRM teams are constantly balancing the need for thorough assessments with the business demand for speed. This roundtable will explore practical approaches to determining when deeper due diligence is necessary, when a lighter-touch approach is appropriate, and how teams can maintain meaningful risk insight without creating unnecessary delays. Participants will share strategies, challenges, and lessons learned for finding the right balance between depth, efficiency, and risk-based decision-making.
|
Nathan Rodgers,Executive Director,JPMorganChase |
 |
Eric Grindstaff,Vice President,JPMorganChase |
Magnolia 3–4
As third parties expand their use of AI, organizations need ways to understand and manage the risks it may introduce. This presentation will explore key elements of a third-party Responsible AI program, including assessments, workflows, risk scoring, dashboards, and assessment history. Audience discussion and a live demonstration will show how Aravo approaches assessing and managing Responsible AI risk across third parties.
 |
Daniel Philemon,Product Marketing Manager,Aravo |
Magnolia 5–6
Contracts often decide how much leverage and protection a TPRM program really has. This session looks at how risk related terms are evolving and how TPRM can influence them without derailing deals. It focuses on a small set of clauses and patterns that consistently matter in practice.
- Key contract topics that have the biggest impact on third-party risk, such as data, resilience, audit, and exit
- Ways to feed TPRM requirements into templates and negotiations in a workable way
- Examples of contract language or structures that improved risk and oversight outcomes
 |
Ryan Hesser,VP TPRM & Legal Counsel,VyStar Credit Union |
 |
Ashley Butler,Director of Third-Party Risk Management,Octane Lending |
Oak 1
When a critical vendor goes down, leaders quickly discover whether roles are clear, escalation paths work, and playbooks are usable in the chaos of a real event. This session is designed for teams that want to turn high-level continuity documents into something they can actually lean on when things are messy and time is short. Using practical examples, and playbook designs to show how teams prepare for disruption, not just react to it, and how to keep plans practical under pressure. The focus is on the elements that make a tangible difference in the first hours and days of an incident.
- Core elements of a workable disruption playbook for third-party failures
- How to define roles, escalation paths, and decision points before an event occurs
- Lessons from exercises or real incidents that led to stronger, more coordinated, and outcome-focused plans
 |
Keith Frantz,Director, Enterprise Risk Management,Prosper Marketplace |
Oak 3
As TPRM programs mature, leaders are being asked to show strategic impact, operate efficiently, and reinforce shared accountability across Procurement, IT, Risk, Compliance, Legal, and Business Units. Many teams also want to move from being viewed as gatekeepers to being recognized as partners who help the business understand risk, make better choices, and own their vendor relationships. This session looks at how programs are repositioning themselves in that direction, with a focus on practical behaviors, governance structures, and engagement models that support the shift.
- Practices that help TPRM demonstrate clear value and relevance to senior leadership
- Approaches for defining and reinforcing shared accountability across core stakeholder groups
- Concrete examples of behaviors, routines, and structures that move TPRM from a control function to a collaborative partner
|
Tim Harvey,Procurement Director,CompSource Mutual Insurance Company |
Key topics
- How to think about both the immediate and long-tail costs of third-party failures, including operational, financial, customer, and regulatory impacts
- Ways to quantify financial exposure and other impacts in a way that drives action, investment, and prioritization from leadership
- Practical actions organizations are taking to reduce the likelihood and long-term impact of third-party failures, from better playbooks and testing to clearer governance and resilience expectations
 |
Katherine Avery,Founder,Chimayo Consulting LCC |
This session examines how that reputation took hold and how AI-enabled assessment approaches are giving programs a path out of it. When technology handles evidence gathering and first-pass analysis, teams spend less time chasing documents and more time delivering what the business actually wants: faster answers, clearer risk context, and earlier involvement in vendor decisions. The focus is on the operating model and culture shift, not any particular tool.
Key topics
- Why traditional TPRM processes earned the “Department of No” label, and what that reputation costs programs in credibility, timing, and business alignment
- How AI-driven assessment and analysis change the speed and depth of risk insight, repositioning the team as a source of answers rather than obstacles
- Practical steps for making the shift stick – stakeholder communication, engagement timing, and metrics that demonstrate the team’s value as a trusted advisor
 |
Paul Valente,Co-Founder & Chief Customer, Officer,VISO TRUST |
Key topics
- New and emerging risk areas being incorporated into modern due diligence programmes
- Embedding cyber, AI, resilience and privacy expectations into existing processes
- Phasing enhancements without overwhelming teams or suppliers
 |
Kaci Johnson,Director, Risk Management,Nelnet |
Key topics
- How to identify and reduce duplicated effort across due diligence and monitoring activities
- Ways to streamline and automate information collection while maintaining confidence in results
- Practical approaches for using monitoring data to inform actions without creating noise for teams or vendors
 |
Matthew Ridenhour,Senior Manager, Compliance Operations,UKG |
Key topics
- Concrete AI use cases already in play in TPRM and the value they delivered
- Common pitfalls and limitations teams have encountered with early AI efforts
- Simple criteria for deciding which AI ideas are worth piloting or scaling
 |
Lindsay Taulton,Operational Risk Analyst,Cornerstone Capital Bank |
Key topics
- How to recognize the signals that a “survival mode” program has outgrown its original design
- Practical lessons from two transformations on building durable structure, buy-in, and operating discipline
- Ways to reframe a program around long-term value and resilience rather than short-term compliance
 |
Tracy Peters,Director, Vendor Program Management,TIAA |
Details coming soon..
 |
Tony Giannino,Senior Director, GRC Engineering,BNSF Railway |
Key topics
- How digital operating models alter traditional assumptions about third-party risk
- Adjustments to scoping, assessment, and oversight that better fit digital services
- Ideas for aligning TPRM activities with broader digital and technology strategies
 |
Corey Hlavack,Senior Director, Information Security,enVista |
Key topics
- Moving from activity metrics to outcome-focused measures
- Metrics that support stronger executive conversations
- Refining reporting to focus on what matters most
 |
Olga Baldwin,Former StoneX Group Inc, Lead of TPRM,Independent |