Practice Guide: Auditing Third-party Risk Management

IIA Global heeft een nieuwe Practice Guide uitgebracht over het auditen van het risicomanagement van het uitbesteden van activiteiten (Auditing third party risk management). De timing daarvan is heel passend, nu samenwerkingsverbanden steeds meer toenemen en het rapport Risk in Focus juist third parties als belangrijk aandachtsgebied voor cybersecurity benoemt. 

Uit onderzoek blijkt namelijk dat 63% van de cybersecurity-inbreuken is terug te herleiden naar derde partijen aan wie taken zijn uitbesteed. Dat maakt third party management een belangrijk onderwerp voor auditors. Deze praktijkgids biedt daar de handvatten voor.

The Practice Guide: Auditing Third Party Risk Management is a useful tool to become better informed on risks related to third-party provider management. Risks across the full vendor life cycle are considered, including the appropriate sourcing, ongoing management, and termination of vendors.

Further exploration into risks resulting from the types of services being provided and the sensitivity of data being shared is covered. Sample audit guidance is offered, making this a robust resource with tangible tools.

Topics include:

• Outlining key roles, responsibilities, and risks in managing third-party providers.
• Defining a third-party risk audit coverage approach.
• Developing a structure for scoping, planning, and executing third-party risk audits.
• Appropriately engaging and assessing third-party risk management activities across the business, oversight, and control functions.
• Determining whether the organization has a third-party risk management structure that results in a “patchwork” approach, and, if so, how to bring it together into an enterprisewide framework.