|
flevyblog
The Flevy Blog covers Business Strategies, Business Theories, & Business Stories.
|
Editor's Note: Take a look at our featured best practice, Supply Chain Resilience (23-slide PowerPoint presentation). Supply Chain "resilience" is the Supply Chain's ability to respond and recover quickly to potential disruptions. It can return to its original situation or grow by moving to a new, more desirable state in order to increase customer service, market share, and financial performance. Resilience is [read more]
* * * *
What Third-Party Risk Scoring Frameworks Reveal about the Limits of Due DiligenceChris Bradley lost his seat on the McKinsey Global Institute’s leadership roster this month. Not for a client failure. Not for a missed number. For a string of LinkedIn posts that the firm decided were incompatible with how it wanted to be seen (Bloomberg reported the removal on October 11). He kept his partnership. He kept his pay grade, most likely. He lost the title that signals institutional trust.
That distinction matters more than it sounds like it should. Reputational risk doesn’t show up on a balance sheet until it already has. Every consulting firm that sells a vendor-vetting framework, a supplier scorecard, or a PESTEL template is really selling one thing: a way to catch what the balance sheet won’t show you in time. The problem is that most of those frameworks are built for environments where the inputs behave. Clean filings. Known jurisdictions. Predictable regulators.
What happens when the inputs don’t behave at all? That’s where the scoring gets interesting, and where most frameworks quietly fall apart.
Most third-party risk frameworks assume a baseline of institutional transparency. A vendor has audited financials. A jurisdiction has a functioning court system. A counterparty has a credit history somebody can actually pull. Deloitte’s global third-party risk management survey, which polled more than 1,300 risk leaders, found that organizations are increasingly weighting ESG and reputational factors alongside the usual financial and operational checks. That’s a tacit admission. The old scorecards, heavy on credit ratios and compliance checkboxes, were missing something.
The something is behavior under pressure. A vendor can look pristine on paper and still fold the moment a regulator changes the rules mid-contract. Harvard Business Review ran a piece years back, still cited constantly in risk circles, arguing that the real skill in managing risk in volatile environments isn’t better models. It’s knowing when the model has run out of road and judgment has to take over. I’ve sat in enough steering committee meetings to tell you that line gets crossed more often than anyone admits in the deck.
Here’s the sharper test case. Nowhere is this tension more visible than in sectors where the entire industry operates across a patchwork of jurisdictions with wildly uneven oversight. Offshore gambling is the cleanest example going. Operators run out of Curaçao, Malta, the Isle of Man, and a dozen smaller licensing bodies, each with its own appetite for transparency and its own tolerance for the kind of corner-cutting that would sink a vendor in a regulated US market overnight. Independent review bodies have had to build their own scoring layers from scratch precisely because standard diligence tools weren’t calibrated for that much jurisdictional spread. The best offshore casinos rankings compiled by outlets covering that space apply a version of exactly this logic: licensing history, payout audit trails, complaint resolution speed, and ownership transparency, scored and weighted the same way a procurement team would vet a supplier operating across six different regulatory regimes at once. Gambling involves real financial risk for consumers, which is a separate conversation from the methodology point here, but the scoring discipline behind those rankings is worth studying on its own terms.
That’s the part worth borrowing. Not the subject matter. The method of building a composite score when no single regulator can vouch for the whole picture.
The PESTEL framework gets taught in every first-year strategy course and then, frankly, gets applied lazily in most real engagements. Political, Economic, Social, Technological, Environmental, Legal. Six buckets, one slide, done. The Strategy Story’s recent breakdown of Grab’s operating environment is a good corrective. Grab sits across transport, commerce, and finance simultaneously, meaning a single gig-worker ruling in one country can move margins in a way that a generic six-box template would never flag with enough urgency.
Weighting is everything. A jurisdiction with weak legal enforcement but strong economic stability scores differently than one with strong legal frameworks and volatile currency controls. Most junior analysts treat PESTEL as a checklist to fill in. The senior ones treat it as a weighting exercise, where three of the six factors usually carry 80% of the actual risk for any given deal.
BCG’s 2026 Applied AI Index put a number on a related governance gap that consultants should sit with for a second: 42% of companies expect their AI agents to act autonomously within four years, yet only 5% currently have the control structures to supervise that autonomy. That’s not an AI story. That’s a scoring story. Organizations are building capability faster than they’re building the oversight to score whether that capability is being used responsibly.
Forbes published its 2026 list of top US management consulting firms this month, and the methodology is worth more attention than the rankings themselves. Forbes and Statista surveyed more than 1,250 clients and 1,050 consultants across 33 service categories between October 2025 and February 2026. Two-sided input. Client satisfaction weighted against peer reputation. Multiple categories instead of one overall score.
That’s the structural difference between a ranking that holds up and one that doesn’t. A single-source score, no matter how rigorous the source, is one failure point away from being wrong. A composite built from multiple independent inputs, weighted and cross-checked, survives a bad data point without collapsing.
Clarion Events’ £2.24 billion acquisition by Informa, announced earlier this month, is a live test of the same principle applied to M&A diligence rather than firm rankings. Informa’s own statement on the deal pointed to Clarion’s events portfolio as a scale play, the kind of rationale that only holds up if the underlying due diligence correctly priced integration risk across multiple business lines rather than treating the acquisition as one monolithic asset.
Three things separate a scoring framework that holds up from one that falls apart the first time a stakeholder challenges it.
First, the weighting has to be documented and defensible before the score gets run, not adjusted afterward to match a preferred conclusion. Second, the model needs a mechanism for flagging when it’s operating outside its calibrated range, the equivalent of a confidence interval, because a framework built for stable mid-cap vendors will misfire badly when pointed at a startup or a cross-border entity. Third, somebody senior enough to override the model has to actually review the edge cases, because the entire point of judgment is that it catches what the formula wasn’t built to see.
Bitsight’s framework for third-party risk management breaks this into tolerance setting, classification, and continuous monitoring, which is a cleaner structure than most internal templates I’ve reviewed. The continuous monitoring piece gets skipped constantly. Most organizations score a vendor once at onboarding and then never touch the file again until something breaks.
Casino M&A gives a live illustration of why that’s dangerous. Fertitta Entertainment’s $17.6 billion acquisition of Caesars Entertainment, expected to close next year according to Casino.org’s recent coverage, carries a heavy debt load that will need continuous reassessment, not a one-time stamp of approval at signing. A scoring model that only runs at the start of a relationship is already out of date by the time it matters most.
What’s the difference between a risk score and a due-diligence checklist? A checklist confirms whether specific items exist, like a license or an audited statement. A risk score weighs those items against each other and produces a comparative number. Checklists tell you what’s present. Scores tell you how much it should worry you.
Why do risk frameworks fail in cross-border situations? Most frameworks are calibrated against a single regulatory baseline. When a vendor or jurisdiction operates outside that baseline, the model’s assumptions about what “normal” looks like stop applying, and scores can look falsely reassuring or falsely alarming.
How often should a third-party risk score be updated? Continuous monitoring beats periodic review for high-variance relationships. Static models that only score at onboarding miss shifts in ownership, regulatory status, or financial stability that can change the risk profile within months.
Is PESTEL still a useful framework in 2026? Yes, but only when the six categories are weighted rather than treated equally. Political and legal factors often dominate in cross-border contexts, while technological and environmental factors may carry more weight in other sectors. Equal weighting is the most common mistake.
Reputational and jurisdictional risk, including the kind that shapes offshore gambling markets, carries real consequences for end users as well as institutions, and anyone researching that space should treat responsible-gambling resources like BeGambleAware.org as a starting point rather than an afterthought.
Scoring frameworks earn their keep by narrowing the field of things a human needs to look at closely. They fail the moment an organization treats the output as a final answer instead of a prioritized list of questions. Chris Bradley’s removal from a leadership role wasn’t something any standard vendor-risk model would have flagged in advance. Reputational exposure rarely shows up where the spreadsheet is looking.
The firms doing this well right now, judging by the composite ranking methodologies at places like Forbes and the continuous-monitoring approach pushed by third-party risk platforms, share one habit. They build the score, then they argue with it. That argument is usually where the real insight shows up.
You can download in-depth presentations on Risk Management and 100s of management topics from the FlevyPro Library. FlevyPro is trusted and utilized by 1000s of management consultants and corporate executives.
For even more best practices available on Flevy, have a look at our top 100 lists:
These best practices are of the same as those leveraged by top-tier management consulting firms, like McKinsey, BCG, Bain, and Accenture. Improve the growth and efficiency of your organization by utilizing these best practice frameworks, templates, and tools. Most were developed by seasoned executives and consultants with over 20+ years of experience.
