Applying Logic in an Illogical World: Third-Party Risk Management at TikTok
summary
Uses if then decision trees to turn onboarding inputs into specific due diligence steps, integrates those playbooks into a GRC tool so questionnaires and notifications auto-generate, and measures success by faster throughput for thousands of vendors and clearer handoffs to procurement/privacy. Experienced reviewers handle unique or AI/biometrics cases, document judgment into the tree, and tune it for 3–6 month tuning; outcomes: fewer blanket SIGs, more SOC2/ISO validation requests, vendor reaction mixed but overall faster and more consistent.
AI-written summary · about
chapters (16)
- 0:00Introduction and disclaimer
- 1:04Why third-party risk matters
- 4:20Challenges in TPRM today
- 8:12Understanding company risk appetite
- 10:20Defining logic in TPRM
- 12:26Low-value repetitive transactions
- 17:05Low-value unique transactions
- 20:18High-value repetitive transactions
- 23:31High-value unique transactions
- 28:31Logic solving volume challenges
- 31:05Logic for fourth-party risks
- 32:30Logic for complex third parties
- 33:34Logic for internal coordination
- 36:22Logic for regulatory compliance
- 37:24Key takeaways and next steps
- 43:04Q&A session
related talks
51mThe Overlooked Security Risk: 3rd Party Risk Management
25mImplementing a Privacy First Strategy
27mThird-party Risk Management: SOC 2s, Security Questionnaires...
32mCybersecurity meets Generative AI: Automating Your Compliance...
11mKeynote: Automating RBI Compliance With Unified Policy-as-Code
36mNot Your Mama's Risk Assessment
12mThe AI Trust Triad for DevOps
44mCybersecurity - Protecting the Organisation's Technological Assets