The complete guide to third-party risk management — and how to make it matter.
If you work in vendor risk management at a financial organization, this is the book you've been looking for.
The Upside of Third-Party Risk Management walks you through every stage of the vendor management lifecycle — clearly, completely, and in practical detail. Whether you're building a program from the ground up, inheriting one that needs work, or taking it to the next level, the frameworks here are ones you can use starting today.
What you'll find inside:
Written by Michael Carpenter — a veteran practitioner with three decades of experience building vendor management, information security, and compliance programs at community banks and credit unions — and Ncontracts Founder and CEO Michael Berman, this book covers the full TPRM lifecycle from the ground up:
- How to define what a vendor relationship needs to deliver before the search begins
- How to tier vendors based on exposure and dependency — and why most tiering frameworks create more work, not less
- What due diligence needs to surface and how to calibrate the depth to the risk
- How to use contracts as enforceable controls
- How to build metrics that reveal whether risk is rising or falling
- How to conduct performance reviews that produce decisions instead of just documentation
- How to manage vendor incidents when they happen — and they will happen
Every chapter is grounded in practice. The examples reflect the environments financial services practitioners work in, where vendor failures have real consequences and oversight has to hold up under examiner scrutiny.
And then it goes further.
Once the foundation is solid, the question changes. It's no longer whether your program meets requirements — it's whether it's doing everything it can for your organization.
That's the other half of this book.
The deeper argument running through every chapter is this: vendors don't just support your organization's strategy. They execute it. Your digital channels, payment processing, fraud monitoring, lending platforms, and customer communications don't sit inside your four walls. They live in a vendor ecosystem that your organization depends on to function, compete, and serve its customers.
Managing that ecosystem well isn't just a risk management discipline. It's a leadership capability.
When vendor oversight is connected to strategy, you stop being the last person in the room and start being the first call. When you can quantify what a vendor failure costs in dollars and strategic timeline, the conversation with leadership changes entirely. When your program reflects how the business operates — not just how it documents oversight — it generates real value: faster decisions, stronger contracts, better outcomes, and a function that earns its seat at the table.
Who this book is for:
New practitioners will find the clearest explanation of how TPRM is supposed to work and why each component matters. Experienced practitioners will find the strategic lens that connects the work they're already doing to the outcomes leadership tracks. Leaders and executives will find the language and frameworks to make vendor risk visible, quantifiable, and defensible at the board level.
Wherever you're starting from, The Upside of Third-Party Risk Management is the best TPRM book to give you both the foundation and the perspective to manage vendor relationships with greater precision, confidence, and impact.
The upside of third-party risk management isn't just a well-run program. It's an organization that knows what its vendor relationships make possible — and manages them accordingly.
