The Physical Assurance Gap in Third-Party Risk

A goods-in inspector at a distribution site checks a delivery against the purchase order: quantity, condition, country-of-origin marking, batch numbers where they matter. The inspector flags a mismatch, logs it and moves on to the next pallet. The check is seldom described as governance, risk or compliance work, least of all by the person doing it. A version of that same check ran through my years on a naval stores account. It raises a direct question for third-party risk management: does the discipline treat physical verification as the assurance evidence it is?

Responsibility for managing risk in day-to-day operations rests with first-line roles (Institute of Internal Auditors, 2020). In the vocabulary of the Three Lines Model, the goods-in check is therefore first-line control testing: verification, independent of the supplier, that what it promised on paper is what arrived. KPMG's two global surveys of 2026 offer the clearest recent picture of where the discipline is spending its attention. One surveyed third-party risk professionals and the other chief ethics and compliance officers.

Where the attention and the money are going

The third-party risk survey drew on 851 professionals across industries and regions (KPMG, 2026). Regulatory compliance and cyber risk dominate strategy, cited by 45 and 48 percent of respondents. Risk assessment and due diligence, and TPRM technology, top the spending list at 52 and 51 percent. More than 80 percent of organisations already outsource core TPRM activities. The companion survey of 725 chief ethics and compliance officers tells a similar story from the compliance side (KPMG, 2026). Of them, 77 percent expect more investment in data analytics and 75 percent in cybersecurity and data privacy, and 64 percent of US respondents name third-party risk management as a target for efficiency gains.

Both surveys also record where that investment is not yet delivering. Only 17 percent of TPRM respondents report the highest tier of data quality, and just 22 percent find their use of AI "very effective" while 50 to 58 percent say they use it. Only 22 percent of compliance leaders are "highly confident" in their organisation's ability to identify and address vendor risk holistically. The TPRM report attributes part of the difficulty to organisations screening every third party, although KPMG's experience puts the genuinely high-risk share at 10 to 20 percent. Those problems have evidence behind them. Physical verification, by contrast, receives little sustained treatment as its own category of evidence, distinct from the questionnaires, certifications and monitoring dashboards that both surveys treat as the whole picture.

The gap the data keeps pointing at

Nth-party visibility, an understanding of the suppliers an organisation's own suppliers depend on, is a critical blind spot, with concentration in a single geography as the standard example (KPMG, 2026). The National Cyber Security Centre's guidance on mapping a supply chain similarly asks organisations to record sub-tier relationships alongside the assurance evidence held for each. Concentration in a geography is a physical fact about where a factory, a warehouse or a single access road is located. Confirming it requires someone to have looked, or to have arranged for someone credible to look.

The same report notes that procurement systems in different countries often fail to roll up into one global view, and frames the problem as an integration failure. Read another way, it describes risk data originating on the ground, site by site, before it reaches any system built to aggregate it. Where frontline capture is weak, downstream integration is unlikely to recover what was never recorded accurately. Fixing the pipe does nothing for water that was never collected at the source.

Some 44 percent of organisations use managed services for ongoing monitoring and 27 percent outsource due diligence (KPMG, 2026), both concentrated at the paperwork-heavy stages of the lifecycle. End-to-end managed services, the model closest to continuous independent oversight of a supplier including its physical operations, account for 5 percent. The industry has built substantial capacity to process what a supplier says about itself, and comparatively little to verify it in person.

That line comes from the TPRM survey itself, offered about fragmented procurement systems, and it may apply equally to a fragmented view of evidence types. A risk register built entirely from self-reported data and system-generated monitoring has a unified view of one kind of signal and no view of another.

The site that stopped shipping

Three trends in the survey data (KPMG, 2026) point to a larger role for physical verification in the next few years. The first is disruption. A third of organisations suffered monetary loss or reputational damage from a third-party failure in the past three years, and 28 percent faced a supply chain disruption. Disruptions of that kind are likely to surface first as a site that has stopped shipping, a flooded warehouse or a change of ownership nobody recorded, well before they appear in a data field.

The TPRM survey's regulatory map adds a second trend. It lists telecommunications supply chain security rules, critical infrastructure protection and operational resilience regimes across the US, UK, EU and Asia-Pacific. Several of these expect organisations to understand physical supply chain structure as well as contractual and cyber posture. A framework built to satisfy them from documentation alone may struggle the first time a regulator asks how a finding was verified.

The compliance survey records the third trend without resolving it: 68 percent of compliance leaders feel "mixed, leaning positive" about AI, while most organisations have yet to meet the data-quality prerequisite for using it well. Generative tools make a polished, plausible self-attestation cheaper to produce than ever. A questionnaire response, a certificate or a monitoring report can be assembled to look complete without the underlying practice being sound. As the cost of convincing paperwork falls, its evidentiary value is likely to fall with it. The value of a fact that cannot be fabricated from a desk may rise accordingly: that the delivery matched the manifest, and that the site looked the way the questionnaire described it.

The people already closing it, without the title

On a naval stores account, several routine physical tasks already perform third-party risk control, carried out by people whose job titles never mention it. The table below maps them against the vocabulary of third-party risk management.

On the accounts I have run, each of those tasks happened routinely without going near a risk register. The observation was made, the exception was raised through an operational channel and resolved as an operational matter, and the risk function had no reason to learn it existed. A supplier that has failed the same physical check three times in a year may therefore look, from the register, exactly like a supplier that has never been checked. The evidence lives in a different system owned by a different function.

A field, a route, a list

The surveys' own recommendation to concentrate effort on the high-risk share of suppliers (KPMG, 2026) can be extended to a category of evidence the surveys did not have in view, using channels that already exist. No new department should be needed, and nobody has to generate more evidence. Each action below routes evidence that is already being produced:

• Name physical verification as its own evidence type in the risk register schema, alongside questionnaire responses and system-generated monitoring
• Route front-line exceptions to the same escalation path as a flagged due-diligence finding, so a repeated physical discrepancy accumulates in the record
• Give front-line staff a short, specific list of what counts as reportable, so the person who already notices something knows it matters
• Weight independent, in-person verification towards the Critical tier, applying KPMG's own "focus your firepower" logic to physical checks
• Treat a physical exception as evidence that corroborates or contradicts the supplier's self-attestation, the same discipline good open-source verification applies to a filing or an ownership record

Against the managed-services spend both surveys describe, the cost looks small, and the decision is whether evidence generated on a loading dock is admissible in the same conversation as evidence generated by a platform. On a Royal Navy supply chain account, physically locating equipment recorded as lost let me close most of fourteen major loss investigations by recovery, and a recovered item closes without leaving a value gap in the account. The case study sets out how it was done.

Failed three times, or never checked

The register and the loading dock hold different kinds of evidence. A register built from questionnaires and monitoring feeds can record that a supplier attested to a control, yet it may have no field for a goods-in or site-visit exception. A supplier never physically checked and one that has failed three checks this year can look the same. The exception is usually resolved within operations and seldom reaches anyone outside it. That matters most for Critical-tier suppliers, because an independent, in-person check within the last twelve months is the evidence least likely to have been written by the supplier itself. From running a Royal Navy stores account, my view is that the physical check is already being done, and the remaining job is giving its result somewhere to go.

The check that goes unseen

On the surveys' own evidence, the answer is largely no. They describe a discipline investing heavily in data, AI and outsourced monitoring (KPMG, 2026), and their own findings on Nth-party blind spots, fragmented data and disruption point towards physical verification without naming it. The goods-in inspector will check the next delivery whether or not anyone names what the inspector is doing. That check is likely to end where it started, resolved as an operational matter and unseen by the risk function. A field in the register, a route for front-line exceptions and a short list of what counts as reportable would let a programme use evidence its people already produce. The people closing the physical assurance gap are in post already, and the register may have nowhere to record what they find.

The views expressed here are my own and are based on general observations about third-party risk management, physical assurance, and supply chain governance. They draw only on published sources and do not represent the position of the Royal Navy, the Ministry of Defence or any organisation with which I work. Nothing published here reproduces any organisation's internal policy, procedure or assurance output.