This latest practice guide informs chief audit executives and their audit teams on how to understand and assess risks related to the use of third-party providers.
Risks across the full vendor life cycle are considered, including the appropriate sourcing, ongoing management, and termination of vendors. Further exploration into risks resulting from the types of services being provided and the sensitivity of data being shared is covered.
It provides structure for planning and executing third-party risk audits appropriate to the size, scale, and risks facing an organization. Example audit guidance is provided, making this a robust resource with tangible tools.
Topics include:
Outlining key roles, responsibilities, and risks in managing third-party providers.
Defining a third-party risk audit coverage approach.
Developing a structure for scoping, planning, and executing third-party risk audits.
Appropriately engaging and assessing third-party risk management activities across the business, oversight, and control functions.
Determining whether the organization has a third-party risk management structure that results in a “patchwork” approach, and, if so, how to bring it together into an enterprisewide framework.
IIA members are invited to download this practice guide and all guidance free as a benefit of membership. Nonmembers may purchase practice guides and supplemental guidance by visiting the IIA Bookstore