Information Risk Has a Measurement Problem 

Enterprises have invested heavily in cybersecurity, GRC programs, security ratings, and third-party risk management. Yet despite those investments, a fundamental business question remains unanswered: how much information risk does the organization truly face, and what could that exposure mean financially?

That gap represents one of the next major challenges for the information risk market: moving from collecting evidence about risk to consistently measuring the risk itself.

As organizations collect increasing volumes of security, compliance, and assurance evidence, the challenge is no longer obtaining information. It's determining what it means for information risk and residual risk. These inputs are difficult to interpret consistently and even harder to translate into comparable measures of residual information risk.

Financial markets rely on standardized measures to compare credit risk, evaluate exposure, and support consequential financial decisions. For example, the FICO score has been around for decades. Information risk has lacked an equivalent measurement system

The Measurement Gap Limits Informed Third-Party Risk Decisions

Without a common basis for comparison, security leaders, finance teams, executives, and boards still struggle to answer a shared set of questions about third-party risk:

• How much information risk remains?
• Which relationships create the greatest exposure?
  
• Are we operating within our risk appetite?
  
• Where will mitigation have the greatest impact?
  
• Which risks should we reduce, retain, or transfer?
  
• What might those exposures mean financially?

The absence of a common, explainable way to translate diverse security evidence into meaningful measures of third-party residual information risk and potential financial exposure creates a fundamental gap in how organizations understand and govern information risk. Without that foundation, governance and consequential decisions depend too often on fragmented evidence, inconsistent methodologies, and subjective interpretation.

Introducing IRIDX: From Evidence to Risk Measurement

IRIDX introduces a consistent, explainable approach to measuring residual information risk and estimating related financial exposure using the assurance evidence organizations already has to improve third-party risk management and governance.

IRIDX is not another assessment, certification, or questionnaire. It addresses the problem too many disparate and diverse artifacts creates: measurement.

IRIDX establishes a common measurement foundation for comparing risk, prioritizing action, and informing financial decisions. By evaluating existing assurance and risk evidence for relevance, rigor, and reliability, IRIDX produces standardized and explainable measures of residual information risk and related financial exposure.

The opportunity is to make information risk more measurable and comparable across the enterprise, creating a common foundation that security, risk, finance, executive leadership, and boards can use to make decisions.

IRIDX helps organizations make more informed and consequential decisions across three critical areas:

• Operational: Prioritize mitigation efforts, identify the highest-risk relationships, and improve the efficiency and scalability of risk reviews.
• Financial: Evaluate potential financial exposure and make more informed decisions about which risks to reduce, retain, or transfer.
• Governance: Compare exposure against risk appetite, identify material exceptions, and provide executives and boards with a consistent basis for oversight and accountability.

IRIDX and HITRUST: Distinct and Complementary Roles

IRIDX is a separate company under common ownership with HITRUST. HITRUST provides frameworks and independently validated cybersecurity assurance; IRIDX focuses on information risk ratings, residual-risk measurement, and financial exposure modeling.

IRIDX builds on nearly two decades of experience in cyber threat analysis, control development, and assurance methodologies. It develops and governs its methodologies under its own governance framework, separate from HITRUST's assurance and certification programs.

The Evolution of TPRM Begins Today

For too long, organizations have had more security evidence than they could consistently translate into business-relevant measures of risk. The next evolution of third-party risk management is not simply collecting more evidence. It is getting more value from the evidence organizations already have. By connecting assurance evidence to residual-risk measurement, financial exposure modeling, and governance, IRIDX opens new possibilities for how organizations understand, compare, reduce, retain, and transfer information risk.

The implications extend beyond TPRM. A consistent approach to measuring information risk creates the potential for a shared language across cybersecurity, enterprise risk, finance, executive leadership, boards, and ultimately other participants that need to understand information risk in business terms.

This is the beginning of a larger ambition: a common language for information risk that can support better cybersecurity, stronger governance, and more informed risk decisions.

To learn more, read the press release and visit IRIDX.com.

Without timely reassessment, material changes in a vendor’s security posture can go undetected between formal reviews.

Why It Matters

Most assurance mechanisms provide a point-in-time view even when vendor environments continue to change after approval. Services expand, systems change, new downstream providers are introduced, and security incidents alter the risk profile. A review that was reasonable at onboarding might lose relevance before the next scheduled assessment.

“Modern businesses rely heavily on third-party partnerships to create value and drive innovation, but they are expanding faster than organizations can manage the risks. According to KPMG research, 83 percent of executives plan to expand their partner networks in the next one to three years, yet 71 percent admit that they have trouble getting their partners to align on goals.” - KPMG 2026 Global Third-Party Risk Management Survey

Limited monitoring also weakens the organization’s response to risk already accepted. A vendor approved with conditions may require enhanced oversight, time-bound remediation, or reassessment when a material event occurs. Without reliable triggers, the exception remains open while the business continues to depend on the service.

What the Evidence Shows

• New 3^rd party research coming soon from HITRUST and CHIME* surveyed over 100 qualified TPRM leaders and found that the vendor approval process took a median of 28 days with almost 1/3 taking 31-60 days to complete.

• The Mitratech 2025 Third-Party Risk Management Study reported that only 29% of organizations could assess risk across the full vendor lifecycle, and that organizations actively monitored only 40% of their vendors on average. 

What TPRM Leaders Can Do

• Set monitoring depth and reassessment frequency according to vendor risk and operational criticality.
• Trigger reassessment when service scope, system access, data handling, control ownership, or downstream dependencies materially change.
  
• Connect incident intelligence, remediation status, and monitoring data to the original approval decision.
  
• Apply enhanced monitoring and clear escalation paths to vendors operating under approved exceptions.
  

Continuous oversight does not require the same intensity for every vendor. It requires enough risk-based monitoring to recognize when the facts behind an earlier decision have changed.

Coming Up in the Next Blog in the Series

If you missed the first blog in the series, please check out it here. Be sure to follow HITRUST on LinkedIn and X to know when the last blog in the TPRM Top 10 series, Closing Perspective on The TPRM Top 10, is posted.  

*CHIME Digital Health Analytics. Third-Party Risk Management Assurance: Strategic Market Validation Survey. Commissioned by HITRUST.  College of Healthcare Information Management Executives, Digital Health Analytics 2026. Survey of 100 third-party risk management practitioners at U.S. healthcare provider organizations with annual revenue of $1 billion or more, fielded August 2026.

Incomplete or unreliable information weakens risk decisions and delays action.

Why it Matters

For vendors already known to the organization, the central challenge is often the quality of the information available. Assurance artifacts may omit critical details, provide vague descriptions, or fail to demonstrate the vendor’s actual security posture. TPRM teams then spend additional time asking questions and requesting evidence that should have been clear at the outset.

“I don’t like wasting time with them back and forth, back and forth, back and forth.” -- TPRM Leader commenting on the challenges with vendor evidence

Poor data can distort onboarding approval decisions, risk tiering, and offboarding resulting in higher risk to the organization. If a relationship is misclassified or its scope is misunderstood, the organization may apply the wrong level of due diligence throughout the vendor lifecycle.

What the Evidence Shows

• New 3^rd party research coming soon from HITRUST and CHIME* surveyed over 100 qualified TPRM leaders and found that “Difficulty getting information” ranked as the second most important challenge.

 TPRM leaders consistently describe to HITRUST their problems receiving assurance artifacts that leave critical questions unanswered regarding scope, inherited controls, fourth-party dependencies, and actual security effectiveness.

What TPRM Leaders Can Do

• Set minimum information requirements for scope, data handling, control coverage, and exceptions.
• Use standardized, independently validated evidence to improve consistency and reduce repeated follow-up.
  
• Treat data quality as a control over the TPRM process because weak inputs can invalidate sound review methods..

TPRM programs do not need more documents for their own sake. They need complete, trustworthy, and decision-ready information that can support consistent risk judgments.

Coming Up in the Next Blog in the Series

If you missed the first blog in the series, please check out it here. Be sure to follow HITRUST on LinkedIn and X to know when the next blog in the TPRM Top 10 series, Vendor Risk Is Changing Faster Than Reassessment Cycles, is posted.  

*CHIME Digital Health Analytics. Third-Party Risk Management Assurance: Strategic Market Validation Survey. Commissioned by HITRUST. Ann Arbor, MI: College of Healthcare Information Management Executives, Digital Health Analytics 2026. In July 2026, HITRUST commissioned CHIME Digital Health Analytics to conduct a blinded market-validation survey of 102 qualified respondents from separate healthcare provider organizations with more than $1 billion in annual revenue. Respondents represented security and GRC leadership, TPRM ownership, procurement and vendor management, legal and contracting, and executive leadership. Every participating organization actively managed at least 200 third-party vendors, and 87% managed more than 500.