Third-party risk management: moving from traditionalist to strategist

Third‑party risk is growing more complex. Proactive, ecosystem‑wide assessment is now essential to manage cyber, data, AI & regulatory risks ISACA Sydney Chapter – October 2026- In Person PD Event As a valued member of the ISACA Sydney Chapter, we are pleased to invite you to our upcoming Professional Development Event - a focused program featuring high‑impact presentations designed to strengthen your capability and deliver practical, actionable insights across cybersecurity, talent strategy and human performance. Event Overview Date: Thursday, 22 October 2026 Time: 5:00 PM – 7:45 PM Venue: EY, 200 George Street, Sydney CPEs: 1 Presenters & Topics Title of the Presentation 1: Third-party risk management: moving from traditionalist to strategist Overview of the Presentation Third-party risk management (TPRM) is becoming more complex and interconnected. Cyber, data, AI, operational and regulatory risks among many others are outpacing traditional approaches. Assessing risk earlier and evaluating dependencies across the third-party ecosystem can improve decisions and strengthen resilience. As third-party networks grow, new approaches can help organisations manage complex risks at scale. Today, leading in TPRM requires a shift from standard compliance efforts toward a more proactive, deliberate approach. Bio of speaker Rolan Moldes is a Sydney-based Partner in Ernst & Young Oceania’s Risk Consulting practice, where he leads Risk Transformation offerings that help organisations navigate complexity, strengthen resilience and enhance the strategic impact of their risk,compliance, and internal audit functions. Drawing on more than 21 years of experience across technology and finance, he advises organisations on third-party risk management, controls transformation and assurance, IT asset management, responsible AI,enterprise and technology risk, governance,compliance, internal audit, and GRC technology enablement. Title of the Presentation 2 : Your Supplier's AI is Now Your Risk: Governing AI Across the Extended Enterprise Overview of the Presentation AI is entering organisations faster than governance can keep up, and often through the back door: embedded in vendor platforms, SaaS tools and supply chain services long before a formal AI strategy exists. In this session, Gergana Winzer looks at how AI is reshaping the threat landscape and third-party risk, from data leakage and model manipulation to AI-enabled social engineering. She also covers how risk and cyber teams can use AI to strengthen their own risk management. Drawing on anonymised examples from critical infrastructure, local government and financial services, she will share practical governance approaches that have worked, the lessons learned along the way, and the key questions every board and risk leader should be asking now. Bio of speaker Gergana Winzer is a cyber security executive with deep experience across critical infrastructure, water, local government and financial services. She recently joined Scyne as a Senior Managing Director, leading the NSW team and building new capabilities nationally. Before that, she was an Equity Partner at KPMG, where she built and scaled the firm's mid-market and private cyber practice, serving clients across financial services, government, critical infrastructure and the corporate sector. Earlier, as Industry Director of Cybersecurity for Asia Pacific at Unisys, she advised federal and state agencies, health and financial services organisations on identity, microsegmentation, security operations and cyber uplift roadmaps. Gergana has served on the AISA National Board and the ISACA Sydney Board, and received the Cyber Leadership Institute Community Award in 2020. She is a regular keynote speaker across Australia, APAC and internationally.