Latest / VoraPrep Audio — Professional Licensure & Certification Exam Prep / [CIA] CIA3: Auditing the Extended Enterprise: Managing Third-Party and Supply Chain Risks
Transcript
- Marcus: Emma, let's start with a story that I think really sets the stage. A huge retailer gets hit with a data breach, affecting millions of customers. The hackers didn't break down the front door; they came in through a side window left open by the HVAC vendor. Emma: Exactly. That case is the classic, and costly, reminder that an organization's risk doesn't stop at its own walls. As a Chief Audit Executive, your assurance responsibilities extend out to that whole complex web of suppliers and partners. We call this the extended enterprise. Marcus: And if you ignore it, you have a massive blind spot. So let's define that. What exactly is "third-party risk" in the context of an audit plan? Emma: It's the umbrella term for any potential threat to your organization that comes from an external party you work with. That could be a threat to your operations, your data, your finances, or even your reputation. It covers everyone from your software providers and contractors to joint venture partners. Marcus: Can you give us an analogy to make that stick? Emma: Think of your company's risk management as a medieval castle. You've built high walls and a strong gate—those are your internal controls. But you give a key to a merchant who needs to make deliveries—that's your third party. If that merchant is careless and leaves the key lying around, your whole fortress is vulnerable. Auditing third-party risk is checking not just your own gate, but how everyone with a key is protecting it. Marcus: That’s a great way to picture it. Now, I hear a couple of other terms used, sometimes interchangeably: "vendor risk" and "supply chain risk." Are they the same thing? Emma: They're related, but distinct. Vendor risk is a subset of third-party risk. It's specifically about the entities you *procure* goods or services from. This is very direct—the company that supplies your office paper, or more critically, the company that hosts your customer data in the cloud. Marcus: Okay, so a vendor is someone we hire and pay directly. What about supply chain risk? Emma: Supply chain risk is broader. It covers the entire end-to-end process of producing and delivering your product. It includes your direct vendors, but also *their* suppliers—what we call fourth parties—plus logistics, distributors, everyone in the chain. Marcus: So if our main software provider is a vendor, their cloud hosting service is part of our supply chain. Emma: Precisely. You have to ask, if our vendor's cloud host goes down, can we still operate? That's a supply chain risk. A disruption anywhere in that chain can bring your operations to a halt, even if your direct vendor is doing everything right. Marcus: So how does internal audit tackle this? It feels huge. You can't audit every single vendor and their vendors. Emma: You can't, and you shouldn't. The key is to take a lifecycle approach. Internal audit's job is to provide assurance over management's *process* for managing these risks. We call it the Third-Party Risk Management program, or TPRM. Audit should be assessing the controls at each stage of that program's lifecycle. Marcus: Let's make that concrete. Can you walk us through an example? Emma: Of course. Let's use a common scenario. A regional bank, Acuity Financial, wants to outsource its customer call center to a new company, ConnectSphere. The CAE is asked to get involved before the contract is signed. Marcus: Okay, so where does the audit team start? What's the first step in the lifecycle? Emma: The first stage is Due Diligence and Selection. Management's job—the first line—is to conduct thorough due diligence. They need to check ConnectSphere's financial stability, their security certifications like a SOC 2 report, their compliance record, all of it. Marcus: And what's internal audit's role in that? Emma: Audit's role is to review the due diligence *process* itself. We ask: Did management follow their own policy? Did they actually get and review that SOC 2 report? Did they assess the disaster recovery plan? We provide assurance that the selection process was sound, not that the selection itself was correct. Marcus: So audit isn't picking the vendor, it's making sure management has a good system for picking the vendor. Got it. What's the next stage after selection? Emma: Next is Contracting. Acuity's legal and business teams will negotiate the contract. They need to include clear Service Level Agreements, or SLAs, data protection rules, and critically, a 'right-to-audit' clause. Marcus: And again, what's audit's action there? We're not at the negotiating table, right? Emma: Absolutely not. That would impair our objectivity. Instead, the audit team can review the draft contract against a checklist of best practices. Does it grant Acuity the right to audit ConnectSphere? Are the penalties for failing to meet SLAs clearly defined? We're ensuring the bank's interests are contractually protected. Marcus: Okay, the contract is signed. They're up and running. Is audit's job done for now? Emma: Not at all. The longest phase is next: Ongoing Monitoring. The business owner at the bank is now responsible for managing the day-to-day relationship and monitoring ConnectSphere's performance against those SLAs. Marcus: And I'm guessing audit comes back later to check on that monitoring? Emma: Exactly. Months later, we might run an audit to test that monitoring process. Is the business owner actually tracking the performance metrics? Is someone reviewing ConnectSphere's updated security reports each year? We're assessing if the controls are still operating effectively over time. Marcus: That makes sense. What about when the relationship eventually ends? Is there a final step? Emma: Yes, Termination and Offboarding. This is a critical control point. When the contract ends, management must ensure all of the bank's data is securely returned or destroyed, and that every single one of ConnectSphere's system access credentials is revoked. Marcus: And audit's role is to check that process. Emma: Right. We can review the offboarding process to ensure it's formalized and effective. You want to prevent any 'lingering access' that could become a security backdoor years later. Marcus: So, to summarize the whole example: in that entire lifecycle, internal audit never said, "Yes, hire ConnectSphere," or "Negotiate for this clause." They only ever provided assurance that management's *process* for hiring, contracting, and managing them was well-designed and effective. Emma: That is the core takeaway. It's the essence of the Three Lines Model. Management owns the risk and the process; audit provides independent assurance on that process. Marcus: We've talked about the process, but what specific *types* of risks are we actually looking for? It can't all be about data breaches. Emma: Correct. They fall into a few key categories. The one we think of most is Cybersecurity risk. That's when a third party's weak security creates a vulnerability for your data or systems. Marcus: Okay, that's the obvious one. What else? What if the vendor just fails to deliver the service they promised? Emma: That's Operational risk. It’s the risk that a third party's failure disrupts your business operations. This is where you audit things like performance monitoring against SLAs and their business continuity plans. Marcus: What about legal trouble? If our supplier breaks a law, like a data privacy regulation, can that blow back on us? Emma: It certainly can. That's Compliance risk. A third party's violation can expose your organization to fines and legal action. So, an audit would focus on management's process for vetting a partner's compliance programs. Marcus: And I imagine if one of our key partners gets caught in a major ethical scandal, our brand gets tarnished, too. Emma: That's Reputational risk. A third party's unethical behavior can absolutely damage your public image. Here, audit assesses management's due diligence on the partner's ethics, culture, and public record. Marcus: One more I can think of. What if a critical vendor just... goes out of business? Emma: That's Financial risk, or what we sometimes call economic risk. The financial instability of a critical third party can cause a massive service disruption if they suddenly fail. Audit would test management's process for evaluating the financial health of key partners, both during selection and on an ongoing basis. Marcus: That framework is really helpful. How do we apply this on exam day when we see a big scenario question? Emma: Use a four-step thought process. First, Identify the Auditor's Role. Is the action in the answer choice an assurance activity, like 'reviewing' or 'assessing,' or is it a management activity, like 'selecting' or 'negotiating'? Discard the management activities. Marcus: Okay, step one: am I acting like an auditor? What's next? Emma: Second, Pinpoint the TPRM Lifecycle Stage. Is the scenario about selection, contracting, monitoring, or termination? That context tells you which controls are most relevant. Marcus: Step two: where are we in the relationship timeline? Then what? Emma: Third, Determine the Primary Risk Category. Is the core issue about data, service delivery, laws, public image, or money? This helps you zero in on the most appropriate audit procedure. Marcus: And the last step? Emma: Fourth, Apply the Three Lines Model. The best answer will always place internal audit firmly in the third line, providing independent assurance. Eliminate any option that has the auditor doing a first- or second-line job. Marcus: You've mentioned staying in our lane a few times now. It sounds like that's where people get tripped up. Emma: It's the most common pitfall. Auditors are problem-solvers, so there's a temptation to jump in and help. Management might ask you to lead the vendor selection team or help negotiate contract terms. But doing so impairs your objectivity. Marcus: Because you can't objectively audit a decision you helped make. Emma: Exactly. It's a fundamental conflict of interest. Your role is to provide assurance *on* the process, not to be *part* of the process. Marcus: Those risk categories—Cybersecurity, Operational, Compliance, Reputational, and Financial—are a lot to hold in your head. Is there a memory aid we can use? Emma: There is. To remember the key categories of risk, just think about giving your vendors a SCORE. Marcus: A SCORE. Okay, how does that work? Emma: S is for Security—that's your cybersecurity and data protection risk. C is for Compliance—their adherence to laws and regulations. O is for Operational—service delivery and business continuity. R is for Reputational—public image and ethics. And E is for Economic—their financial stability. SCORE. Marcus: Security, Compliance, Operational, Reputational, Economic. That’s perfect. Emma: Remember, on the exam, you'll see scenarios about vendor failures or selection. The best answer will almost always be the one that has the CAE or internal audit focusing on evaluating the *process* management uses, not on performing management's duties. Marcus: This is the kind of practical advice that makes all the difference. For more lessons that break down complex topics just like this, listeners should definitely check out the app. Emma: That's right. VoraPrep is a full exam-prep app — lessons, practice questions, and an AI tutor in one place. You can get started at Vora Prep dot com. It's free to try. Marcus: So let's bring it all home. What are the key takeaways on auditing the extended enterprise? Emma: First, recognize that third-party risk is broad, and that vendor risk and supply chain risk are critical pieces of it. Second, remember internal audit's role is to provide assurance over management's program, not to manage the risk ourselves. Third, a solid audit approach looks at the entire lifecycle: due diligence, contracting, monitoring, and termination. And finally, always maintain your objectivity by staying in your third-line role. Marcus: Fantastic, Emma. And to everyone listening, you're putting in the work, and it will pay off. Keep going. We'll see you next time. Emma: Take care, everyone.