Third Party Risk Sme

A Third Party Risk SME ("subject matter expert") is the person an organisation turns to for judgement on the risks created by its suppliers, outsourcers and other external providers - from cloud hosting and payroll bureaux to cleaning contractors and offshore call centres. They assess suppliers before contracts are signed, monitor the riskier ones afterwards, and help the business decide whether a given arrangement is safe, legal and resilient enough to proceed. The work sits mostly in banks, insurers, asset managers, large tech and telecoms firms, the NHS and government bodies, and in consultancies selling this capability to those clients.

Approximate graduate salary

For graduates entering as an analyst, typically around GBP 26,000-35,000 to start, with London and financial services roles at the upper end and public sector or regional roles lower. Roles genuinely advertised as 'SME' usually assume prior experience and pay well above graduate entry level. These are broad approximations and vary a great deal by employer, sector and location.

What you'd actually do

Working through supplier due diligence questionnaires - long structured forms covering a supplier's information security, data protection, financial stability, subcontractors and business continuity - and chasing the vendor's team when answers are vague or evidence is missing
Reading evidence documents such as security certifications, penetration test summaries, audited accounts and disaster recovery test results, and judging whether they actually cover the service being bought
Running assessment calls with a supplier's security, legal or operations staff, and with the internal business owner who wants to use them, to pin down what data the supplier will hold and what happens if they fail
Writing up risk findings and recommendations - typically a rating, the specific gaps found, and either required remediation actions or a documented acceptance of the risk by a named business owner
Maintaining the third party register (the central record of who the organisation buys from and how critical each one is), tidying inconsistent data and flagging contracts coming up for reassessment
Advising colleagues in procurement, legal and the business on what the organisation's own policy and the regulator require - for example whether an arrangement counts as outsourcing, or whether a contract needs audit and exit clauses
Attending governance forums where the riskiest suppliers, overdue remediation actions and contract exits are discussed, and preparing the papers and slides for them

How graduates get in

Graduate schemes in risk, audit, compliance or operations at banks, insurers and large corporates - common route; you rotate through teams and may land in third party or operational risk, often not by choosing it in advance
Consulting graduate schemes in risk and regulatory advisory, technology risk or cyber - a very common feeder, because consultancies sell third party risk programmes to financial services clients and staff them partly with juniors
Direct entry into a junior third party risk analyst, vendor risk analyst or supplier assurance analyst role - these are advertised at graduate level, though often without the 'graduate scheme' label and sometimes through recruitment agencies
Sideways from procurement - starting as a procurement or category assistant and moving into the risk side of supplier management; a well-trodden path and often the quickest if you can't get a risk scheme
Sideways from information security, internal audit or data protection, where you already know how to test controls and simply apply it to suppliers rather than internal teams
Note on the title itself: 'SME' usually signals a role above pure graduate entry. Many adverts for Third Party Risk SME expect prior experience, often a few years. Graduates realistically enter as an analyst or associate and grow into the SME label.

What employers ask for

Degree subject usually does not matter much. Business, law, economics, computing and information security are all common, but so are humanities graduates who can write clearly and think about evidence. Some technology-heavy teams prefer a computing or cyber background
A 2:1 is the typical bar on structured graduate schemes; direct-entry analyst roles are often more flexible and weigh relevant experience more heavily
Professional qualifications are usually taken after you start rather than before. Common ones include the International Compliance Association certificates, CISA or CRISC for the audit and IT-risk side, CIPS for the procurement side, and the Institute of Risk Management's qualifications. Employers often fund these
Some exposure to regulated-industry thinking helps for financial services roles - an awareness of the FCA, PRA and Bank of England's operational resilience and outsourcing expectations, and of DORA for firms with EU operations. You are not expected to know the detail on day one
Any experience of structured document work - audit, compliance, legal, data protection, placement years in procurement or risk - is valued more than the degree itself
For roles genuinely advertised as 'SME' rather than analyst, expect a requirement for prior hands-on third party or operational risk experience and the ability to work unsupervised

Skills that matter

Reading evidence critically

A supplier will send a certificate or a policy document that looks reassuring; your job is to spot that it covers a different office, expired last year, or excludes the exact service you are buying.

Clear, decisive written English

Your output is largely risk write-ups read by people who have no time - a finding has to state the gap, the consequence and the required action in a few lines without ambiguity.

Holding a position under pressure

Business colleagues often want a supplier signed off by Friday and will push hard; you need to be able to say what the real risk is and what conditions you would accept, without either caving or blocking everything.

Basic information security and data protection literacy

Most supplier risk now turns on where data sits, who can access it, and what UK GDPR requires of processors and sub-processors, so you need enough grounding to ask the right follow-up questions.

Spreadsheet and data-tidying competence

Third party registers are notoriously messy - duplicate entities, missing contract end dates - and a lot of real value comes from someone who can reconcile and clean that data reliably.

Process discipline and follow-through

Assessments run on tight cycles with dozens of suppliers in flight, and findings only matter if someone chases the remediation actions to closure months later.

Where it leads

Analyst or associate - you work through assessments assigned to you, with a senior reviewing your ratings and write-ups before they go out.
Senior analyst - you own the harder, higher-criticality suppliers, review junior colleagues' work and start advising the business directly rather than through your manager. Reaching this point commonly takes a few years but varies widely by employer and sector.
Subject matter expert or manager - you become the person who interprets the policy and regulatory expectations, designs the assessment approach, and handles the contentious cases. Some people stay here long term because it is a genuinely specialist role; others move into managing a team.
From there the paths fork: deeper into operational resilience and outsourcing policy, into broader operational risk or internal audit, into procurement and supplier management leadership, or into consultancy where third party risk specialists are in steady demand.
Senior destinations include head of third party risk management, operational resilience lead, or a route towards wider second-line risk and compliance leadership. Timelines here vary enormously and depend as much on sector and organisation size as on performance.

What people get wrong

“'SME' in the job title means small and medium-sized enterprises, so the role is about lending to or working with small businesses.”

In this context SME means subject matter expert - the in-house specialist others consult. The acronym clash is genuinely confusing and catches people out when searching job boards.

“It is a procurement job about getting better prices from suppliers.”

Commercial negotiation sits with procurement. Third party risk is a control function asking a different question - if this supplier is breached, goes bust, or quietly moves the work offshore, what happens to our customers, our data and our regulatory position?

“It is form-filling and box-ticking with no real influence.”

There is genuine questionnaire work, especially early on, but the substance is judgement calls - deciding which gaps are tolerable, where to push back on a business sponsor, and when a critical supplier relationship should be exited. Regulatory attention on outsourcing and operational resilience has given the function real weight in regulated firms.

“You need a technical cyber security background to do it.”

Security literacy helps, and some teams are very technical, but much of the role covers financial stability, concentration risk, modern slavery and labour standards, data protection, geographic and subcontractor risk, and contract exit planning. Teams usually blend technical and non-technical specialists.

Where this varies

The role differs sharply by sector. In banking, insurance and asset management it is heavily driven by regulatory expectations on outsourcing and operational resilience, with formal governance committees, defined critical suppliers and board-level reporting - these teams are the largest and most structured. In tech, retail and telecoms the focus tilts towards information security and data protection assurance, often sitting inside the security function rather than a risk function. In the NHS and central government the emphasis is on public procurement rules, continuity of essential services and social value obligations. In consultancies you will work across several clients at once, building or reviewing their frameworks rather than running day-to-day assessments. Team size matters too: in a large bank you may specialise narrowly in one assessment domain, whereas in a smaller firm the same person covers supplier risk, business continuity and data protection together.

General guidance about the role across the UK market, not about any specific employer. Entry routes and requirements vary — always check the individual job advert.