You can spot a good TPRM specialist under DORA by the concrete answers they give about the register of information, ICT contracts and exit plans. The interview questions below let you test that in a single conversation.
At banks, insurers and pension funds, third party risk management has become a discipline of its own. DORA has applied since 17 January 2025, and the work lands with a small group of people who understand both contracts and ICT risk. Those people are scarce. So you need to see quickly in the interview who has actually done it.
What a TPRM specialist under DORA actually works on
Financial institutions keep a register of information covering all contractual arrangements for ICT services provided by third parties. This year the Dutch central bank, DNB, requested that register with a reference date of 31 December 2025 and a deadline of 20 March 2026, to be submitted as xBRL-CSV or through DNB's Excel template. Banks under direct ECB supervision report to the ECB. That submission also kicks off the annual European process for designating critical ICT third-party providers.
That designation has already happened once. On 18 November 2025 the European Supervisory Authorities published the first list of critical ICT third-party providers that they will assess themselves. DNB puts the number at 19. My reading: you remain responsible for your own supplier management, and an accurate register only becomes more important, because the designation is based on those registers.
The hardest part is the contracts. A sector-wide DNB survey in early 2025 found that almost 95% of institutions had updated their outsourcing policy. Yet only 34% had brought all ICT contracts supporting a critical or important function in line with DORA. DNB called amending those contracts an important area of attention.
Seven interview questions for a TPRM specialist
You don't need twenty questions. These seven give you enough of a picture, and each one comes with what to listen for.
1. "How did you build the register of information, and where did the data come from?"
A strong candidate talks about sources: the contract management system, the CMDB, procurement, the business owners. They know the data is scattered and that the first version always has gaps. Probe on subcontractors further down the chain. Someone who describes the register purely as a spreadsheet exercise probably didn't build it themselves.
2. "How do you decide whether an ICT service supports a critical or important function?"
The heaviest obligations hang on that classification, so you want precision here. A good answer starts with business functions and the impact analysis, not with the supplier list. Also listen for whether the candidate says who makes the final call. That isn't the TPRM specialist.
3. "Which contract did you last make DORA-compliant, and where did you get stuck?"
This is where you see the difference between someone who knows a checklist and someone who has sat across the table from a supplier. Ask about the difficult suppliers, the ones reluctant to move away from their standard terms. Did it end in an addendum, an escalation through procurement or an accepted residual risk? DNB saw that many institutions used the contract addenda from the Dutch Association of Insurers and the Pension Federation. A candidate from that world will know them.
4. "What is in an exit plan you wrote yourself?"
An exit plan on paper is quick to produce. Ask whether it has ever been tested. Someone who really wrote the plan also knows how long the switch takes according to it. If the candidate only says "we have an exit clause", they didn't write the plan.
5. "How do you present supplier risk to the board?"
Under DORA, responsibility sits with the management body. In the same survey DNB pointed out that at 20% of institutions that had not yet finished, residual risks had not been formally accepted by the board, referring to Article 5(2) of DORA. A good TPRM specialist writes up a residual risk so that a board member can say yes or no to it. Ask for an anonymised example.
6. "Where do you draw the line between TPRM and procurement?"
There is no wrong answer, but there is a weak one: "it doesn't matter". The specialist sits between procurement, legal, the CISO organisation and the business. You want someone who knows which decision belongs to whom and doesn't work around it.
7. "What do you need to deliver something in the first month?"
An interim specialist has to show results fast. A good answer is concrete, for example access to the contract system and a decision on scope. If you get a vague story, the first month goes on searching.
Pay attention to what the candidate asks you
An interview works both ways. A good freelancer asks straight away what the deadline is and how many days a week they need to be in the office. I saw that at a grid operator I was recruiting for. The team there had two or three fixed office days, and for someone living on the other side of the country that decided whether they responded at all.
My advice: have those two answers ready before you schedule the first interview. And if a candidate asks nothing at all about the assignment, that tells you something too.
Interim for the catch-up, in-house for afterwards
I don't think you should give the catch-up on contracts and the register to someone doing it for the first time. Bring in an experienced interim specialist for that and have someone from your own team work alongside them. The register goes to the supervisor again every year, so someone has to keep it up to date afterwards.
If you're weighing up hiring models, read this comparison of six models. We find interim specialists through MVPeople, and if you want someone in your team for longer, that works through secondment with MVProfessionals. The profiles are on our page about TPRM specialists, and what's happening in the financial sector is on banking and finance.
Want to hold these questions up against a specific profile? Call or email me and we'll work out together what you need.