The thing that changes on September 15 is not that internal audit starts paying attention to third-party management. Audit has been looking at third-party risk for years. What changes is that the judgment behind that scrutiny stops being subjective. For...