Why are Organizations Not Managing Third Party Security Risk

Third-party information security risk management (TPISRM) is a growing concern for organizations and their security programs, yet many fail to realize why its importance extends beyond regulations and compliance. What should the why be behind your TPISRM program, and why aren't all organizations doing this?