Vendor relationships and the technology behind them can change after onboarding. We use the Shared Assessments framework to help insurers review and monitor vendors in proportion to their risk, with documented oversight you can demonstrate to boards and regulators.
Insurers rely on vendors across critical business functions, often with strong review processes already in place. But vendors and their products change over time. New technology and AI capabilities can be introduced after onboarding, creating risks that earlier assessments may not address. Regulatory expectations also continue to evolve.
It may be time to take a closer look at your third-party risk management (TPRM) program, starting with these questions:
Concerns can emerge first through work already underway elsewhere in the organization.
From there, the decision is whether each vendor relationship is still assessed and monitored at the level of risk it presents, and whether any gaps call for vendor-level reassessment or changes to the program itself.
Johnson Lambert’s TPRM offerings address your overall program and the individual vendors within it.
We tailor the work to your current program and the risks your vendor relationships present. Engagements can address a defined need or span the full third-party lifecycle.
, the organization behind the industry-standard TPRM Product Suite used by more than 15,000 organizations worldwide. That framework guides our approach to scalable, risk-calibrated, defensible, and audit-ready oversight. 
Where we are not your financial statement auditor, our team can work alongside yours on program design and implementation. For existing financial statement audit clients, our role is limited to assessment, findings, and recommendations. Management retains responsibility for remediation, vendor decisions, and risk acceptance.
Our cybersecurity work is informed by decades of experience serving insurance organizations and nonprofits, with teams that understand the regulatory, operational, and governance issues affecting these sectors.
years serving insurance organizations, with specialized teams to navigate the industry's unique regulatory expectations, reporting requirements, and operational landscape.
insurance clients nationwide, spanning property and casualty, life, health, title, reinsurance, captives, and MGAs.
largest auditor of P&C insurers nationwide. Deep familiarity with governance and oversight expectations, and active involvement in the AICPA, NAIC, and IASA to keep our teams close to the issues affecting insurance leaders.
years of niche-focused experience, with nonprofit teams committed to supporting foundations and associations of various sizes and complexities.
nonprofit clients nationwide, including CDFIs, PACs, member organizations, professional societies, religious, arts & cultural, and social service organizations.
in organizations such as AICPA, NAIC, IASA, ASAE, and Association Forum keeps our team close to the issues affecting insurance and nonprofit leaders.
Our experts bring insurance-focused experience across third-party risk, AI governance, cybersecurity, SOC reporting, and internal audit.
A vendor’s SOC report can reveal gaps on both sides of the relationship. Learn what to look for and how to act on the findings.
READ MORE →
A vendor’s SOC report can reveal gaps on both sides of the relationship. Learn what to look for and how to act on the findings.
READ MORE →
Could your existing cybersecurity controls miss threats introduced by AI? Explore what auditors test and how to prepare your organization for a closer look.
READ MORE →
Talk with our third-party risk team about your current approach, how AI may be changing your vendor relationships, and where added assessment or program work may be needed.
Schedule a Conversation
