Most firms discover the gap the same way: a supplier goes down, and the questions start.

• You know who your suppliers are. You do not know what they do for you: A contract register tells you who you pay. It does not tell you which supplier sits between a member and their money on a Friday afternoon.

• Your assurance is annual. Your exposure is daily: A questionnaire completed in March tells you very little about the supplier that was breached in September, acquired in October and restructured in January.

• You are borrowing faster than you are governing: Payments, digital platforms, identity, financial crime tooling, and now AI. Outsourcing has outrun the frameworks built to oversee it.

• The regulator has moved on and the bar has moved with it: SS2/21 set the expectation. The Critical Third Parties regime and DORA's reach into UK groups have raised it. Supervisors now treat third party risk as enterprise risk, and expect boards to do the same.

• Consolidation inherits other people's decisions: For building societies in particular, every acquisition brings a supplier estate that someone else selected, contracted and assured, with a risk profile you now own and did not choose.

If you cannot answer "which third-party failing would stop us serving members tomorrow" in a sentence, that is the gap.

• We find out what you actually depend on: Not the supplier list. The path from a member outcome back through every party that touches it, including the ones your suppliers use and never told you about.

• We replace annual assurance with continuous visibility: Through the DCR TPRM Centre, powered by Risk Ledger, you see supplier posture as it changes rather than as it was reported. Fourth party exposure and concentration become visible instead of assumed.

• We build oversight that fits the firm you are: An eight person risk function does not need a model designed for a global bank. We use our nine dimension maturity model to set a target that is proportionate, defensible and reachable, then get you there.

• We do the running, if you want us to: Assessment, chasing, escalation and reporting can sit with us as a managed service, so your team spends its time on the decisions rather than the administration.

• We keep you current as the rules and the estate move: SS2/21, the CTP regime, operational resilience impact tolerances and Consumer Duty all land on the same supplier estate. We keep the mapping between them intact so you are not rebuilding it every time something changes.

• A board conversation that lasts ten minutes instead of an hour, because the answer is on one page

• Concentration and fourth party exposure you can see rather than suspect

• A supervisory response that is evidenced rather than assembled the week before

• Faster onboarding of new suppliers, because the assurance route is already built

• The confidence to borrow more, which is the point

When a supplier fails, and one will, the difference is whether you are discovering your exposure or managing it.

Your suppliers hold capability you will never build in house. Treat them as a risk to be policed and that is all you will ever get from them. Treat them as capability to be borrowed well, and they become the reason you can move faster than firms three times your size.