In an era defined by hyper-connectivity and complex global supply chains, the ability of an organization to vet, monitor, and govern its third-party relationships has shifted from a back-office administrative task to a core strategic imperative. As regulatory scrutiny intensifies and the proliferation of Artificial Intelligence (AI) introduces unprecedented risk vectors, the Ethics & Compliance Initiative (ECI) Compliance Week and Diligent have collaborated on a landmark benchmarking study. This report, designed to serve as a compass for risk professionals, provides an empirical look at the current state of Third-Party Risk Management (TPRM).
The findings of this joint study will be formally unveiled during a dedicated webcast on December 1, 2026, at 2:00 pm ET, where industry veterans will dissect the data to provide actionable intelligence for compliance programs worldwide.
The Landscape of Modern Third-Party Risk: Core Findings
The collaborative research effort between ECI and Diligent was born out of a clear necessity: the gap between theoretical compliance frameworks and operational reality. As organizations expand their vendor ecosystems to include niche technology providers, cloud services, and global logistical partners, the surface area for potential malfeasance, data breaches, and ethical lapses has grown exponentially.
Defining the Scope of Third-Party Oversight
The study highlights a critical evolution in how compliance departments define "risk." Historically, third-party due diligence was largely confined to financial stability and basic anti-bribery/anti-corruption (ABAC) screenings. The new benchmarks reveal a shift toward a holistic, 360-degree view. Modern programs are now integrating ESG (Environmental, Social, and Governance) metrics, cybersecurity posture, and, most notably, the ethical deployment of AI within the vendor’s own infrastructure.
The Friction Points in Due Diligence
One of the most anticipated insights from the upcoming report involves the "bottleneck analysis." According to preliminary data, many organizations are struggling with the transition from manual, spreadsheet-based vetting to automated workflows. The research identifies the exact junctures where reviews slow down:
- Initial Risk Scoring: The lack of standardized data ingestion from vendors.
- Enhanced Due Diligence (EDD) Triggers: Ambiguity in when to escalate a routine check to a deep-dive investigation.
- Cross-Departmental Silos: The friction between procurement, legal, and compliance teams when reconciling disparate risk appetite profiles.
Chronology: From Static Screening to Dynamic Risk Management
To understand the current benchmarks, one must look at the rapid evolution of the industry over the past decade.
- 2016–2019: The Era of Check-the-Box Compliance. Programs focused primarily on the Foreign Corrupt Practices Act (FCPA) and UK Bribery Act compliance. Third-party vetting was largely reactive, triggered by contract renewals.
- 2020–2022: The Pandemic Stress Test. The global supply chain disruption forced companies to realize they had little visibility into their "fourth and fifth-tier" suppliers. This period accelerated the adoption of digital TPRM platforms.
- 2023–2025: The Rise of AI and Cyber-Risk. As AI became integrated into business workflows, compliance departments were tasked with auditing not just vendor ethics, but vendor algorithms.
- 2026: The Benchmark Pivot. The current ECI/Diligent study marks the transition to "Intelligence-Led Compliance," where turnaround times and program maturity are measured against peer-group benchmarks rather than internal goals alone.
Supporting Data: Benchmarking Against Peers
The upcoming webcast will provide participants with a quantitative framework to evaluate their own programs. While the full report is reserved for members and attendees, the preliminary release suggests several key areas of measurement:
Review Volumes and Efficiency
The study indicates that organizations with high-maturity programs are processing 30% more third-party risk assessments than they were three years ago, yet their turnaround times have decreased by 15%. This paradox is explained by the strategic use of AI-driven automation to filter low-risk vendors, allowing human analysts to focus exclusively on high-risk engagements.
Annual TPRM Spend
A significant focus of the research is on the allocation of capital. Is the budget being spent on headcount or technology? The data shows a growing trend toward "Integrated Risk Tech Stacks," where compliance teams are moving away from fragmented tools toward unified Diligent-style platforms that integrate GRC (Governance, Risk, and Compliance) with real-time continuous monitoring.
The AI Imperative
Perhaps the most crucial segment of the research covers AI governance. With the rapid adoption of Large Language Models (LLMs), the study asks: How are you vetting the AI your vendors use? The data suggests that while 70% of organizations have a policy on their own AI use, less than 40% have a formal, documented process for auditing the AI tools deployed by their vendors.
Perspectives from the Field: Official Responses
The presentation on December 1 will be led by two of the most respected figures in the industry: Maurice L. Crescenzi, Jr., President of ECI Compliance Week, and Kristy Grant-Hart, Vice President of Compliance Advisory Services at Spark Compliance (a Diligent brand).
In a joint statement previewing the event, Crescenzi noted:
"The compliance landscape is no longer static. Organizations that rely on last year’s risk profile are already behind. Our goal with this collaboration is to provide a mirror for the profession—a way to see where you stand in relation to the industry standard and, more importantly, where you need to evolve."
Kristy Grant-Hart added:
"The complexity of third-party risk has reached a breaking point. We are seeing firms struggle with the ‘paradox of choice’—too many tools, too much data, and too little insight. This report is about stripping away the noise and focusing on the metrics that actually correlate with ethical outcomes and risk reduction."
Strategic Implications: What This Means for Your Organization
The implications of the ECI/Diligent findings are profound for Chief Compliance Officers (CCOs) and General Counsels.
1. The Cost of Inaction
The report underscores that regulatory bodies—including the DOJ and SEC—are increasingly viewing "failure to monitor third parties" as a sign of an ineffective compliance program. The benchmark data provides a defense: by aligning with industry-standard review times and due diligence depth, organizations can demonstrate a "good faith" effort to mitigate risk, which is a critical factor in potential enforcement actions.
2. The Competitive Advantage of Compliance
Organizations that can streamline their vendor onboarding process gain a competitive edge. A company that can vet a vendor in 48 hours is significantly more agile than one that takes three weeks. The study shows that high-maturity programs are effectively using compliance as an engine for speed-to-market.
3. Preparing for the "AI Audit"
As the regulatory environment catches up to AI technology, firms will eventually be required to provide evidence of "AI Due Diligence." The ECI/Diligent findings provide a roadmap for this transition. By adopting these benchmarks now, organizations can avoid a reactive, panicked response when regulators issue definitive guidance on AI-in-the-supply-chain.
4. Continuous Monitoring vs. Periodic Review
The final major implication is the obsolescence of the "annual review." The data proves that continuous, trigger-based monitoring is not just more effective at catching risk, but often more cost-efficient over the long term. The study provides the business case for moving away from periodic re-certifications toward real-time risk signaling.
Conclusion: Join the Conversation
The release of the ECI Compliance Week and Diligent survey is more than just a data dump; it is a call to action for the compliance community. By participating in the December 1st webcast, professionals will gain access to the granular metrics required to optimize their TPRM programs.
Whether you are a seasoned CCO looking to refine your department’s efficiency or a risk analyst seeking to implement best-in-class vetting procedures, the benchmarks contained in this report provide the foundation for a more resilient, ethical, and agile organization.
Webcast Details:
- Date: December 1, 2026
- Time: 2:00 pm ET
- Registration: Available via the ECI Compliance Week portal.
- Credits: Included with membership.
As the corporate world becomes increasingly interconnected, the ability to see and manage the third parties operating in your shadow is not just a regulatory requirement—it is the hallmark of a resilient enterprise. The data provided by ECI and Diligent will serve as the essential roadmap for that journey in the year ahead.
