In an era where global supply chains are increasingly interconnected and regulatory scrutiny is at an all-time high, the management of third-party risk has transitioned from a back-office administrative task to a strategic imperative. To shed light on the current state of this critical function, the Ethics & Compliance Initiative (ECI) Compliance Week and Diligent have collaborated on an extensive benchmarking survey.
The findings of this research, set to be unveiled during an exclusive webcast on December 1, 2026, at 2:00 pm ET, promise to provide practitioners with the data necessary to calibrate their programs against industry standards. By examining the mechanics of third-party risk management (TPRM), the influence of artificial intelligence, and the evolving expectations of regulators, this report serves as a vital barometer for compliance professionals navigating a complex risk landscape.
The Core Findings: A Landscape in Flux
The joint ECI and Diligent report aims to dissect the operational realities of modern compliance departments. As organizations expand their vendor ecosystems to include niche software providers, international logistics partners, and specialized consultants, the "attack surface" for reputational and legal risk has grown exponentially.
Key Data Points for Benchmarking
The upcoming presentation will focus on several critical pillars of TPRM performance:
- Program Maturity Models: How do the structures of nascent compliance departments differ from mature, integrated risk functions?
- Review Volume and Velocity: Identifying the bottlenecks that hinder onboarding and periodic review processes.
- Financial Allocation: A breakdown of annual TPRM spend, providing a baseline for budget benchmarking.
- Due Diligence Triggers: A look at the risk-based approaches organizations use to decide when "standard" vetting is insufficient and "enhanced" due diligence (EDD) is required.
By providing these metrics, ECI and Diligent aim to move the conversation beyond subjective anecdotes and toward evidence-based program design.
Chronology of Third-Party Risk Management
To understand why this benchmarking report is arriving at this specific juncture, one must look at the evolution of risk management over the past decade.
Phase 1: The Compliance Checklist (2015–2019)
In the mid-2010s, TPRM was largely synonymous with anti-bribery and corruption (ABC) compliance. The focus was on ensuring that third parties were not facilitating illicit payments, primarily driven by the enforcement of the U.S. Foreign Corrupt Practices Act (FCPA) and the UK Bribery Act.
Phase 2: The Resilience Era (2020–2023)
The COVID-19 pandemic acted as a massive catalyst for change. Supply chain disruptions forced organizations to look beyond legal compliance and into operational resilience. Suddenly, the focus shifted to financial stability, business continuity, and cyber-security vulnerabilities embedded within vendor networks.
Phase 3: The AI and Regulatory Pivot (2024–2026)
We are currently in the third wave of TPRM. The rapid adoption of artificial intelligence has introduced a new layer of risk. Organizations are now forced to evaluate not just what a vendor does, but how a vendor uses AI to process data, make decisions, or secure their own systems. This is the precise context in which the new ECI and Diligent report was formulated.
Supporting Data: The Anatomy of Modern Due Diligence
The benchmarking report digs deep into the operational friction points that compliance officers face daily. One of the most anticipated sections of the report is the analysis of "turnaround times."
Preliminary insights suggest that as compliance departments demand higher standards of vetting, the duration of the vendor onboarding process has increased. This creates an inherent tension between the "Compliance Office" and "Procurement/Business Units," who are often incentivized by speed and time-to-market.
The AI Variable
Perhaps the most innovative aspect of the survey is its focus on the "AI-in-Compliance" phenomenon. The study does not merely look at how the compliance department uses AI to screen vendors (such as automated adverse media screening); it also investigates how organizations are vetting their vendors’ internal AI governance.
Questions addressed in the report include:
- AI Transparency: Are vendors required to disclose the Large Language Models (LLMs) they use?
- Data Sovereignty: How are vendors ensuring that client data is not being used to train third-party AI models?
- Algorithmic Bias: Are there mechanisms to audit the outputs of AI-driven tools provided by vendors?
Official Perspectives: The Experts Weigh In
The webcast will be led by two prominent voices in the compliance industry, offering deep professional insight into how these benchmarks should be interpreted.
Maurice L. Crescenzi, Jr.
As the President of ECI Compliance Week, Crescenzi has been at the forefront of policy development and professional education. His perspective on the report emphasizes the cultural aspect of compliance—moving beyond mere documentation to ensure that third-party relationships align with the ethical core of the parent organization.
Kristy Grant-Hart
Representing Spark Compliance, a Diligent brand, as the Vice President of Compliance Advisory Services, Grant-Hart brings a pragmatic, "in-the-trenches" approach. Her expertise lies in the practical implementation of compliance programs. According to Grant-Hart, the data contained in this report is not just a collection of numbers but a roadmap for resource allocation. "When you see that your peer group is spending X amount on automated screening, it provides the leverage needed to justify necessary technology investments to the C-suite," she notes.
Implications: The Strategic Future of Compliance
The implications of the ECI and Diligent report extend far beyond the compliance department. They touch upon corporate strategy, risk appetite, and the future of enterprise partnerships.
1. The Cost of Compliance
As the survey highlights the financial commitment required for mature TPRM programs, leadership teams will likely face pressure to either increase budgets or accept higher levels of residual risk. There is no longer a "cheap" way to manage a global, digital supply chain effectively.
2. The Standardization of "Best Practice"
By aggregating data from a wide variety of organizations, this study creates a "gold standard." For smaller or less mature firms, this report serves as a goalpost, helping them prioritize their compliance roadmap—starting with high-risk vendor segmentation and moving toward continuous monitoring.
3. A Call for Agility
The report suggests that the organizations that succeed are those that treat TPRM as a dynamic process rather than a static annual check-the-box exercise. With AI evolving at a breakneck pace, the ability of a compliance team to pivot their due diligence questionnaires to address new technological threats will define the winners of the next decade.
4. Regulatory Expectations
Regulators, from the DOJ in the United States to the European Commission, are increasingly looking for evidence of "effective" compliance programs. Benchmarking is the best evidence of effectiveness. Being able to demonstrate that your program meets or exceeds the industry standard provides a robust defense in the event of an investigation.
Conclusion: Join the Conversation
The ECI and Diligent benchmarking survey is more than a report; it is a vital tool for the modern risk professional. In a world where the speed of business is dictated by digital infrastructure, the speed of trust must keep pace.
Attendees of the December 1st webcast will not only gain access to the data but will also have the opportunity to participate in a discussion about how these findings translate into real-world action. Whether you are seeking to optimize your current spend, justify a new AI-driven vetting tool, or simply understand where your program sits on the spectrum of industry maturity, this session is designed to provide the clarity required to move forward with confidence.
Registration Information:
The webcast is included with ECI Compliance Week membership. Interested parties are encouraged to register early, as this report is expected to become a foundational document for compliance teams throughout 2027. By aligning your program with these new benchmarks, you are not just ensuring regulatory compliance—you are building a more resilient, transparent, and ethically grounded organization.
For more information on the ECI Compliance Week and Diligent survey, or to register for the upcoming webcast, visit the official event portal. Stay ahead of the curve and ensure your third-party risk management program is equipped for the challenges of tomorrow.
