Supplier risk information at Edward Jones sits across several teams, and supplier relationships keep changing between reviews. The third-party risk management team is applying AI to intake, assessments, and continuous monitoring, so analysts spend less time on manual work and more on the risks that need their judgment.
Fragmented data, growing complexity
Managing third-party risk at a large financial institution means working across a complex network of suppliers, changing relationships, and emerging risks.
At Edward Jones, critical supplier information spans business resilience, cybersecurity, technology, and business teams. Each function contributes useful intelligence, but disconnected data makes it hard to keep a complete, current view of supplier risk.
We have our data sort of siloed across business resilience, threat vulnerability, technology, as well as our business.
Assessments are an important foundation, but supplier relationships don’t stand still between reviews. New subprocessors, changing technology, and emerging threats can introduce risks that periodic assessments alone may miss.
For Edward Jones, the opportunity is to connect existing data, find the signals that matter, and help a lean risk team make better-informed decisions.
“What we’re really looking for is opportunities to reduce manual effort, improve the consistency of our assessments.”
AI across the supplier lifecycle
Edward Jones is exploring how AI can reduce repetitive tasks and improve consistency across supplier intake, assessments, and continuous monitoring. The goal is to give analysts the time and information to focus on higher-value risk decisions, not only to finish compliance work faster.
- Intake. AI-assisted inherent risk questionnaires can pull out details such as subprocessor lists and whether an application uses AI, and surface them during intake. Business teams get help completing questionnaires, and analysts get the context to validate and challenge responses.
- Assessments. Supplier due diligence often means reviewing hundreds of pages of documentation. AI can extract relevant evidence, summarize findings, and link them to source documents, so analysts spend their time evaluating controls, finding gaps, and assessing exposure.
- Continuous monitoring. Connecting monitoring with intake and assessment data helps analysts see how emerging risks relate to the firm’s actual supplier exposure.
Throughout, Edward Jones holds to one principle: AI supports human judgment rather than replacing it.
Starting with the suppliers that matter most
Edward Jones is building continuous monitoring with a targeted approach, beginning with its most critical suppliers. Instead of generating alerts across every possible risk domain, the team is identifying which signals are relevant to each supplier relationship and which would warrant action.
By starting small and refining the approach, the team aims to build a monitoring program that delivers actionable intelligence without overwhelming analysts with noise.
More time for risk decisions
For Edward Jones, the value of AI goes beyond efficiency. Less manual effort and better access to relevant information can give risk professionals more time to assess higher-risk activities, engage suppliers, and support the business.
It also connects activities that have historically been separate. Intake sets the context of a supplier relationship. Assessments evaluate its risks and controls. Continuous monitoring builds on that knowledge to identify meaningful changes over time. Together, they can support a more complete view of supplier risk without manual workload growing at the same rate.
From reactive to proactive
Edward Jones is expanding its AI and continuous monitoring capabilities deliberately, prioritizing critical suppliers and the signals most relevant to each relationship. The long-term goal is to identify potential issues earlier, giving the team more time to investigate, engage suppliers, and reduce exposure before problems escalate.
As Spencer Funke put it, the objective is to “be more proactive versus reactive in our TPRM programs.”
“We’re not turning on continuous monitoring for everything day one.”
