While third party risk management is an ongoing challenge, experts say it may not be fully solved by new rules.