Building a Resilient Third-Party Risk Management Capability. An Integrated Risk-Based Decision-Making Model for Insurance Undertakings, from Onboarding to Exit

Abstract

Insurance undertakings increasingly depend on external parties for critical services, ICT infrastructure, data processing, distribution and innovation. This structural shift turns third-party management into a core governance issue, reinforced by a dense and evolving European regulatory framework: Solvency II, DORA, GDPR, CSRD, CS3D and the AI Act. This project thesis, written from the position of Head of Qualitative Risk Management at Ethias, addresses a specific problem: Ethias already holds substantial Third-Party Risk Management (TPRM) foundations, built through its Solvency II outsourcing governance and its DORA compliance programme, but these remain fragmented across functions, tools and referentials. The central research question asks how Ethias can design a risk-based strategic decision-making model that reconciles regulatory defensibility with operational resilience, across the full third-party lifecycle, from onboarding to monitoring, remediation and exit. The methodology combines an academic and practitioner literature review, a regulatory analysis, five semi-structured interviews with representative functions (Procurement, CISO, Internal Audit, Business Continuity Management and Risk Management), and the design of an integrated model. The proposed model connects existing building blocks rather than replacing them: an Inherent Risk Questionnaire for preliminary classification, a Consolidated Risk & Value Scoring, an extended TPRM Gate, and an integrated register, all anchored in Ethias' existing risk appetite framework and three-lines-of-defence governance. The thesis does not quantify the value of TPRM, nor does it apply the model to a single supplier case. Its contribution is methodological and architectural: it establishes the coherence, defensibility and implementability of the model within Ethias' context. Its central argument is that the value of TPRM is defensive and comparative: a mature, integrated framework does not generate margin, but it can leave an insurer better prepared than a less-invested competitor to withstand third-party shocks, which plausibly turns resilience into a source of competitive advantage.