AI That Actually Helps TPRM with Brian Shaw

Send us Fan Mail “100% automated vendor risk assessments” sounds seductive right up until you are staring at unstructured SOC 2 reports, mismatched ISO certificates, and a queue you cannot clear. Greg sits down with Brian Shaw, a long-time third-party risk and compliance leader, to talk about what AI can realistically do in third-party risk management today, and what it absolutely should not do yet. We start with a blunt warning: do not automate a broken process. If a question does not change a risk decision, answering it faster does not improve your TPRM program. From there, we get practical about the best use case most teams feel immediately, evidence collection and normalization. Brian explains how AI and natural language processing can extract risk signals from SOC reports, contracts, and policies, then compare sources to flag contradictions with citations so a human can make a defensible call. We also dig into the human side: analysts are not getting replaced if they build strength in materiality, investigation, mitigation, and relationship management. Then we zoom out to modern vendor risk architecture: annual assessments as a photograph, risk as a movie. We talk continuous monitoring, material events, and why context must stay connected from intake through renewal. Finally, we tackle fourth-party and concentration risk, including the uncomfortable truth that “vendor diversity” can collapse into one shared cloud or model provider dependency, and how risk graphs can help you see the real blast radius. Subscribe for more practitioner-level conversations, share this with your risk team, and leave a review with the one TPRM workflow you would automate first. Support the show