Established Players and New Entrants: Mapping the TPRM Technology Landscape

The third party risk management (TPRM) technology market has moved a long way from spreadsheets and SharePoint — but it's also more fragmented than ever. In this episode of Third Party Therapy, host Mike Day speaks with Harj Mattu, a Deloitte partner specialising in third party management technology and transformation, about the state of the TPRM technology market, where AI is actually showing up, and the lessons learned from implementations that have gone wrong.
 
There Is No Silver Bullet
 
Harj's central message is that TPRM technology should be thought of as a toolkit, not a single platform. Even the strongest solutions typically need augmenting — a best-in-breed TPRM workflow tool like Aravo or Process Unity will usually need integration with external data intelligence providers and sourcing or buying systems, while a procurement-rooted platform may offer less mature native TPRM capability than a specialist tool.
 
The Established Players
 
Harj names the vendors that consistently appear in client shortlists across sectors: Aravo and Process Unity remain fixtures in "best practice, end-to-end" conversations, with Process Unity, in his reading of external market research, having edged ahead recently. Coupa Risk Assess retains strong functional capability, though Harj notes its user experience can be a trade-off. OneTrust and ServiceNow have both invested significantly in their own TPRM capability in recent years.
 
New Entrants Pushing the Market
 
Harj highlights CERTA as a vendor doing something genuinely different — not just using AI to support risk assessment, but using AI to help configure and deploy the workflow itself, generating a tailored risk assessment workflow for a given category or risk domain rather than requiring extensive manual setup.
 
Data Aggregators and Screening Providers
 
Beyond workflow tools, Harj points to a growing category of data intelligence aggregators — he names Interos, Supply Horizon and Craft — which combine data from multiple sources to support a risk assessment end to end, sitting alongside longer-established screening providers such as Dun & Bradstreet and Refinitiv
 
Industry Differences: Regulated vs Less-Regulated Sectors
 
Harj observes that heavily regulated sectors — financial services, life sciences, healthcare — tend to gravitate toward tried-and-tested vendors, partly because buyers want proof of a track record with comparable, similarly regulated organisations, and partly because of the growing regulatory expectation (he cites DORA and similar regimes) that risk assessments trace clearly through into contract terms and ongoing monitoring. Less regulated sectors — retail and some technology companies among them — are often more willing to take a chance on smaller, newer vendors.
 
Where AI Is Actually Showing Up
 
Harj is candid that AI adoption within TPRM technology specifically has lagged behind other domains, such as contract lifecycle management, where use cases for data extraction are more established. Within TPRM today, he sees AI most concretely in document and evidence review (automating what was previously manual evaluation of supplier-submitted evidence), and in orchestration — providing a single front door for business users who would otherwise have to navigate multiple disconnected tools. He sees the next frontier, agentic AI actually running parts of a standardised risk assessment process end-to-end, as a significant opportunity that the market hasn't yet fully delivered on.
 
Orchestration: The "Amazon Experience"
 
Harj names Zip, Oro and ServiceNow as vendors receiving significant investment and attention in the orchestration space specifically — aiming to give business users a single, seamless front end, similar to a retail checkout experience, that routes a request to the right underlying process (procurement, TPRM, or both) without the user needing to understand the distinction.
 
Procurement vs TPRM: A Growing Technology Divergence
 
Echoing a theme from earlier episodes with Oliver Jones, Harj estimates — based on his own client engagement experience rather than published research — that the proportion of organisations he works with that keep TPRM technology strategy separate from procurement has grown from roughly 40% to as much as 60-70% over the past year, driven by TPRM's expanding scope into intermediaries, distribution partners, agents, and even sell-side customer risk.
 
Lessons Learned: Overcomplicating the Questionnaire
 
Asked for the single biggest implementation mistake he's seen repeatedly, Harj points to scope creep in questionnaire design — risk domain owners, each passionate about their specific area, piling additional questions into an assessment until the user experience collapses under its own complexity, regardless of how flexible the underlying technology is. His clear advice: resist adding every stakeholder's request, and keep the assessment proportionate to genuine risk.
 
Lessons Learned: Reporting as an Afterthought
 
A second recurring gap: TPRM platforms are generally strong workflow tools but weaker reporting tools, and organisations that don't plan their data model and reporting strategy from the outset often find themselves unable to produce the board-level, regulator-ready reporting they need without extensive manual rework.
 
Getting Started: Prioritise Where Value Comes From
 
Harj's practical advice for anyone planning or refreshing a TPRM technology strategy: map the end-to-end process and honestly assess which capability (workflow, screening, reporting, data aggregation) would deliver the most value for your organisation's specific maturity stage, rather than trying to improve everything simultaneously. Most organisations, he notes, are now well aware that this is a multi-vendor "jigsaw" rather than a single-platform decision — the discipline now is in sequencing that jigsaw sensibly.
 
Listen to the full episode of Third Party Therapy, on Apple Podcasts, Spotify, Amazon Music, Audacy and YouTube, or visit thirdpartytherapy.com to subscribe to the mailing list.
 
 
### Tags
 
#ThirdPartyTherapy #TPRM #TPRMTechnology #ThirdPartyRiskManagement #VendorRiskManagement #RiskManagementTechnology #OrchestrationTools #AIInTPRM #AgenticAI #ProcessUnity #Aravo #ServiceNow #OneTrust #DataAggregation #RiskManagementPodcast #WhatTPRMSoftwareShouldIUse #HowIsAIChangingTPRM #TPRMPodcast