How to Build a Third-Party Risk Management Budget Case When There Is No ROI Number
Budget season arrives with the same problem every year. You know what your program needs. You know what happens if it does not get it. And you cannot produce the one thing the process is built to compare: a return.
Every other request in the room has one. A sourcing initiative promises savings. A systems project promises hours. Yours promises that something will not happen, which is real, and which no budget template has a field for.
This is not a presentation problem, and a better slide will not fix it. It is a structural mismatch between what prevention work produces and what a budget process is designed to evaluate. Understanding the mismatch is what lets you argue around it.
Why the ROI Model Fails for Prevention Work
A working third-party risk program produces an absence. No fraud loss. No sanctions exposure discovered by a regulator before you found it. No supplier failure that nobody saw building.
The problem is that a year in which nothing went wrong looks identical to a year in which nothing was going to go wrong anyway. From outside the program, and certainly from a finance seat, there is no observable difference between the two.
So when you build an ROI model for prevention work, you end up projecting a return that cannot be evidenced, and everyone in the room knows it. The number gets larger to compensate for being unprovable, which makes it less credible rather than more. The most common failure in a TPRM budget request is not asking for too much. It is asking with a number nobody believes, including the person presenting it.
Why the Request Gets Deferred Instead of Refused
Notice what actually happens to these requests. They are rarely rejected outright.
Rejecting one means someone puts their name to the position that the current exposure is acceptable. Few people will write that down about third-party risk, because if the exposure is later realised, the record of that decision is the first thing anyone looks for.
So the request gets deferred instead. Next cycle. When there is more room. Once the current program lands.
Deferral achieves the same outcome as a refusal, with one important difference: nobody owns it. There is no decision to point at, no name attached, and no record that a judgement was ever made about the underlying exposure.
Meanwhile, the work still has to happen. The commitments still get made, the exceptions still get granted, and the system records that they happened without recording why. That is the position you are actually asking to change.
What to Count Instead of What to Project
Here is the shift that makes the request arguable: stop projecting a return and start describing an exposure.
A projected return is an argument about the future, and the committee has to take it on trust. An exposure is a fact about the present, and someone can go and verify it. The second is a smaller claim and a far more durable one.
Three things are worth counting before your next budget conversation. None of them requires new tooling, and all of them can be produced in an afternoon.
Commitments that live nowhere in the system of record. Take your active supplier list and sample twenty relationships. For each, ask the relationship owner what has been agreed beyond the signed contract: pricing concessions, service commitments, remediation promises, agreed exceptions. Then check how many of those appear anywhere in your system. The gap is your number.
Decisions that cannot be reconstructed. Pull the exceptions and approvals from the last twelve months. For each one, ask whether you could produce who approved it and on what basis, without asking a person. Count the ones where the answer is no. Then note how many of those people still work there.
Exceptions with no documented owner. Pull everything currently open. Count the items with no named owner and no remediation date. These are the ones that surface during an audit, and they surface as findings rather than as managed risks.
These numbers tend to come back worse than anyone expects, which is uncomfortable and useful in equal measure. They also change the shape of the conversation. You are no longer asking the organization to believe a projection. You are describing what it is already carrying, and asking whether it intended to.
