ESG & Resilience: Transforming Third-Party Risk and the Extended Enterprise
The regulatory landscape for Environmental, Social, and Governance (ESG), operational resilience, and third-party risk management (TPRM) is undergoing a profound transformation. Organizations across Europe—and those operating within European supply chains—are feeling the impact of the looming EU Corporate Sustainability Due Diligence Directive (CSDDD) as well as the EU Digital Operational Resilience Act (DORA). These regulations are driving a shift from fragmented, reactive third-party risk management processes to integrated, proactive strategies that emphasize not only ESG, but also operational resilience. It is about integrity and resilience of the extended enterprise. I am interacting on a number of developing strategies and RFPs as several organizations have told me their most significant third-party risk is now the EU CSDDD.
The EU CSDDD, effective from 2026, marks a significant change in corporate accountability. It compels companies to assess, prevent, and mitigate adverse impacts on human rights, the environment, and corporate governance (such as bribery and corruption, privacy, cyber risk) throughout their entire value chain, including suppliers, outsourcers, vendors, service providers, subcontractors, and other third parties. This shift extends beyond compliance, pushing companies toward a more ethical and sustainable future. Alongside this, but separate, EU DORA focuses on ensuring the resilience of financial institutions and their critical third-party service providers, particularly in the areas of IT, cybersecurity, and operational continuity. Together, these directives are reshaping third-party risk management for the modern enterprise across industries (yes, DORA is financial services specific but impacts a lot more). I am interacting with some organizations that refer to their ESG strategies as ‘strategic resilience.’
Organizations cannot let third-party risk be this scattered mess that it so often is within organizations. The future of regulation, but most importantly integrity and resilience, requires an integrated strategy that is supported by technology, intelligence, and assurance.
The Role of ESG and Resilience in Third-Party Risk Management
The components of ESG—Environmental, Social, and Governance—play a critical role in the transformation of TPRM.
- Environmental. The “E” requires organizations to evaluate their suppliers’ policies on climate change mitigation, resource efficiency, and biodiversity protection. I have had several interactions where one of the top concerns is forever chemicals in the supply chain. Companies must ensure their supply chains comply with environmental standards, adopt circular economy principles, and minimize pollution. These efforts are reinforced by monitoring and due diligence activities, supported by third-party risk intelligence.
- Social. The “S” emphasizes human rights, labor practices, and workplace safety. The EU CSDDD prioritizes addressing forced labor, child labor, and unsafe conditions. It requires organizations to assess and ensure suppliers’ commitment to fair treatment, equitable wages, and safe working environments. Social accountability is becoming integral to supplier evaluations, with companies focusing on shared values within their supply chains.
- Governance. The “G” focuses on business ethics, anti-corruption, cybersecurity, privacy, and accountability. Governance requirements extend beyond internal operations, compelling companies to verify that third-party partners maintain ethical practices, prevent bribery, and adhere to data privacy and cybersecurity standards. Organizations must ensure that their suppliers’ governance structures align with regulatory and ethical mandates, safeguarding the integrity of the entire value chain.
Resilience, as emphasized by EU DORA, is a critical addition to this framework. DORA mandates that financial institutions and critical service providers, including cloud providers, ensure operational continuity in the face of disruptions. This means companies must assess the resilience of their third-party partners, ensure they have robust incident response plans, and continuously monitor for potential disruptions that could impact business operations. Resilience now plays a central role in the extended enterprise, alongside ESG commitments.
The Shift from Fragmented to Integrated TPRM Programs
Many organizations have traditionally managed third-party risk through siloed, department-driven processes, with procurement, legal, compliance, and IT each managing risk assessments independently. The EU CSDDD, CSRD, and DORA demand a unified strategy that bridges these functional divides. Companies are now working to establish integrated TPRM programs supported by modern technology and intelligence architectures.
This transformation requires multi-departmental collaboration. Legal, compliance, procurement, supply chain, human resources, IT, and sustainability departments must coordinate efforts to develop a comprehensive third-party due diligence strategy. Governance committees are being established to oversee risk activities, ensuring alignment with corporate ESG objectives and operational resilience goals.
To achieve this, organizations are adopting centralized third-party risk management platforms. These platforms provide a unified view of third-party risks, from onboarding and due diligence to ongoing monitoring all the way to offboarding. Risk intelligence feeds play a critical role, providing real-time insights into environmental, social, and governance risks in supply chains, as well as operational threats such as cybersecurity risks and IT system failures. Companies are leveraging automation and artificial intelligence (AI) to streamline workflows, identify hidden risks, and enhance overall efficiency.
Building a Holistic ESG- and Resilience-Driven TPRM Strategy
To meet the demands of the EU CSDDD (and CSRD), and DORA, organizations must develop a holistic ESG- and resilience-driven TPRM strategy. Success requires clear governance, robust risk assessment, continuous monitoring, and transparent reporting. Key steps in this process include:
- Accountability. Establishing accountability at the executive and board level is a foundational step. Executive sponsors must drive ESG compliance initiatives, supported by cross-functional risk oversight committees that span legal, compliance, procurement, IT, and sustainability teams. Accountability structures ensure that ESG commitments and operational resilience goals are enforced throughout the organization and its supply chain.
- Onboarding. Comprehensive due diligence and supplier onboarding are essential. Organizations must evaluate potential suppliers based on ESG and resilience criteria before entering into contracts. Supplier codes of conduct are developed to set clear expectations for ESG compliance and resilience commitments, ensuring suppliers commit to ethical, sustainable, and resilient practices.
- Monitoring. Risk assessment and continuous monitoring are crucial to ESG- and resilience-driven TPRM. Companies are using third-party risk intelligence feeds to track environmental, social, and governance risks in real-time. Automated alerts notify companies of supplier non-compliance, regulatory changes, adverse media coverage, and operational risks such as cybersecurity threats or natural disasters, enabling proactive responses to emerging risks.
- Resilience. When issues arise, companies must have clear processes for remediation and corrective action. This includes escalating, addressing, and reporting third-party ESG and resilience issues. Companies should also define contractual remedies, such as termination clauses, for suppliers that fail to comply with ESG or resilience commitments.
- Engagement. Training and awareness initiatives play a vital role in embedding ESG and resilience principles within the organization and its supply chain. Training internal teams and third-party partners ensures that everyone understands the company’s ESG commitments, operational resilience obligations, and compliance obligations. Training on TPRM platforms and risk intelligence tools helps teams maximize the technology’s potential.
- Assurance. Assurance activities are essential to verify that companies and their third parties are meeting ESG and resilience requirements under the EU CSDDD, CSRD, and DORA. Companies must conduct regular audits of high-risk third parties, ensuring compliance with ESG and operational resilience criteria. Self-assessment questionnaires (SAQs) are used to gather direct responses from suppliers about their adherence to ESG and resilience policies, as well as certifications to demonstrate compliance. Organizations are also adopting verification processes that leverage third-party audits to ensure suppliers uphold their ESG and resilience commitments. These independent audits provide objective assurance that suppliers are meeting regulatory obligations and ethical standards. When non-compliance is detected, organizations must address gaps through remediation and corrective action plans.
- Reporting. Finally, eporting and assurance are essential for demonstrating compliance with ESG and resilience regulations. Companies must provide assurance on third-party compliance with ESG standards and resilience requirements through regular reporting, dashboards, and independent audits. Verification processes, such as supplier self-assessments and independent certifications, offer additional assurance of supplier integrity and compliance.
ESG and resilience are driving a transformation in third-party risk management, pushing companies toward an integrated third-party risk strategy and architecture (technology and intelligence/content). Fragmented risk management strategies are being replaced by unified, multi-departmental strategies supported by modern technology and third-party risk intelligence. This approach requires companies to collaborate across functions, leverage TPRM platforms, and adopt proactive risk assessment and monitoring techniques.
The future of third-party risk management is clear: ESG and resilience are no longer “nice-to-have” but regulatory necessities. Companies must adapt to ensure their extended enterprise aligns with Environmental, Social, and Governance principles while also ensuring operational resilience. Doing so strengthens corporate integrity, builds trust with stakeholders, and ensures regulatory compliance under the EU CSDDD, CSRD, DORA, and beyond. Companies that successfully navigate this transformation will gain a competitive advantage, while those that fail to act risk penalties, reputational damage, and loss of market access.