How Internal Audit Will Assess Third-Party Governance

The IIA’s Third-Party Topical Requirement sets the baseline internal auditors must follow when they audit how an organization manages its third parties. It’s organized into three components: governance, risk management, and controls. Together they cover the full relationship, from deciding whether to use a third party to offboarding one.

Third-party governance sits at the top. When internal audit reviews third-party management, the IIA tells auditors to take a top-down approach, starting with an understanding of your policies, procedures, processes, framework, and life cycle. Much of that understanding comes from your governance, which makes it the frame for everything that follows.

In my first article on the Third-Party Topical Requirement, I covered what it is and how to get ready. This article is the first of three that break down each component. I’ll walk you through the four governance requirements, what auditors may ask to see as evidence, and how to get ready.

What the Governance Component Covers

Third-party governance covers how your organization oversees its use of third parties as a whole, including key guidelines, oversight, and accountability. The Third-Party Topical Requirement focuses on four areas of governance:

• Deciding whether to use a third party: a formal approach for deciding whether to contract with a third party in the first place.
• Policies and procedures: how third-party relationships and risks are managed across the full life cycle, aligned with applicable regulations and kept current.
• Roles and responsibilities: who is responsible and accountable across the life cycle, and whether those people have the right skills to do the work.
• Stakeholder communication: defined protocols for keeping stakeholders informed, including timely reporting on the performance, risks, and compliance of third parties, prioritized by risk.

In any audit where the Third-Party Topical Requirement applies, governance is in scope by default unless the auditors’ risk assessment shows it doesn’t apply. For example, an audit of another area that relies on a third party, such as a system hosted by a cloud provider, may leave governance out and focus on the controls over that third party’s services.

Here’s a breakdown of the four requirements when governance is in scope for an audit.

Breaking Down the Four Governance Requirements

1. Deciding Whether to Use a Third Party

The first requirement looks at how your organization decides whether to use a third party at all. Auditors will assess whether you have a formal approach for making that decision, whether it’s followed, and whether it’s reviewed periodically. The approach should include criteria for deciding whether you have the resources to handle the work in-house or need a third party to provide it.

This requirement sits upstream of where many third-party management programs begin. The decision to go outside is often made in the business or procurement, so the evidence may live with another team.

What audit may ask to see:

• A documented, approved approach for deciding whether to use a third party, with evidence it’s periodically reviewed
• A cost-benefit analysis or budget that justifies engaging the third party
• Management’s evaluation of the risks and controls involved, including how issues with the third party will be handled
• Evidence of adequate resources to contract with, manage, and monitor the relationship
• Evidence that input from stakeholders is built into the approach

2. Policies and Procedures Across the Life Cycle

The second requirement looks at whether your policies and procedures define, assess, and manage third-party relationships and risks across the full life cycle, which the IIA defines as selecting, contracting, onboarding, monitoring, and offboarding. They also need to align with the regulations that apply to your organization and be reviewed and updated periodically.

Most programs have a third-party management policy. Auditors may look at whether the procedures behind it set clear criteria for each stage of the life cycle. Ongoing monitoring and offboarding are where procedures are most often thin, so give those a close look.

What audit may ask to see:

• Defined criteria for selecting, contracting, onboarding, monitoring, and offboarding third parties
• Standard tools and templates for key governance, risk management, and control processes
• A process for periodically reviewing policies and procedures and updating them
• How applicable regulatory requirements are identified and checked against your policies
• Benchmarking against leading third-party management practices

That last item is worth noting. The IIA lists benchmarking as evidence auditors may review, so knowing how your program compares to leading practices strengthens your governance story.

3. Roles, Responsibilities, and Competencies

The third requirement looks at whether roles and responsibilities are defined for who selects, directs, manages, communicates with, and monitors third parties, and who needs to be kept informed. It also requires a process to make sure the people in those roles have the competencies to carry them out.

Third-party management involves a lot of people, from business owners and procurement to information security, legal, finance, risk, and compliance. Ownership tends to blur where those roles meet.

Documenting who owns each step of the life cycle, and who needs to be kept informed, covers the first half of this requirement. The second half asks for a process to make sure those people have the right skills, which matters most for business owners who manage third parties alongside their other responsibilities. The IIA also points to roles aligned with its Three Lines Model, so auditors may look at how responsibilities divide between the business units that manage third parties and the functions that oversee them.

What audit may ask to see:

• Documented roles and responsibilities across the full life cycle
• Regular training for people in third-party management roles, with periodic assessment of their competencies
• A way to confirm training has built awareness of third parties across the organization
• A process for checking that a third party’s values and ethics align with yours, and for addressing conflicts of interest
• Roles that align with the Three Lines Model

4. Communicating With Stakeholders

The fourth requirement looks at whether protocols are defined for communicating with relevant stakeholders, including timely reporting on the performance, risks, and compliance of prioritized third parties, with breaches of laws and regulations called out specifically. Stakeholders can include the board, senior management, procurement, operations, risk management, compliance, legal, IT, information security, and HR.

Two things stand out here. Reporting centers on prioritized third parties, meaning third parties ranked by importance and risk, so this requirement depends on having a risk-based way to rank them. Reporting also covers performance alongside risk and compliance, so the people managing service delivery and the people managing risk need to feed the same picture. Auditors will look for defined protocols covering who receives what and how often, and for evidence that the reporting is happening.

What audit may ask to see:

• Defined protocols for who receives reporting on prioritized third parties, what it covers, and how often
• Meeting minutes, reports, or emails that share third-party risks and known vulnerabilities with stakeholders
• Periodic cross-functional meetings where third-party information is exchanged

How to Get Your Third-Party Governance Ready for Internal Audit

Auditors assess both design and implementation, meaning whether your governance is documented and fit for purpose, and whether it’s operating the way it’s documented. For each requirement, you’ll need both the documentation and the evidence. Here are a few practical steps to get there:

• Start with what you already have. Map your current policy, procedures, committee structure, and reporting against the four requirements. You’ll see what’s working well and where to focus, and you’ll have a clear story to share with auditors and leadership.
• Know how audit plans to scope it. Ask internal audit whether your next third-party audit covers your program as a whole or specific third parties. That tells you whether they expect to leave any governance requirements out and where to focus first.
• Connect to the decision upstream. If the decision to use a third party is made outside your scope of operations, find out who owns it, how it’s documented, and how it hands off to your intake process.
• Back defined roles with training. Give business owners and others who manage third parties role-specific guidance and training, and keep a record of it.
• Make reporting routine. Define what your stakeholders receive on prioritized third parties and how often, then keep the reports and meeting minutes that show it’s happening.

See Where Your Program Stands Today

We developed a simple, 20-minute online self-assessment to measure your third-party management program against the Third-Party Topical Requirement, including the four governance requirements covered here. You’ll get a gap analysis report that shows what you’re already doing well and where to focus first. And your individual results stay private to you.

Take the Self-Assessment

If you want help closing the gaps, our Internal Audit Readiness service provides a comprehensive assessment of your program against all audit requirements and builds a phased roadmap, with a business case to take to leadership. Contact me at trogers@vendorcentric.com to talk through where your program is today.