Third-Party Process Risks and Controls (CIA Part 2: Engagement Planning)
Introduction
Organizations increasingly rely on external parties such as cloud service providers, payroll processors, logistics firms, outsourced call centers, IT managed service providers, contract manufacturers and consultants to perform critical business processes. When a process is outsourced, the activity moves outside the organization, but the accountability for its risks stays with the organization. In CIA Part 2 (Practice of Internal Auditing), Third-Party Process Risks and Controls appears within Engagement Planning. Internal auditors must know how to identify, assess and plan engagements that cover risks arising from third-party relationships.
Why It Is Important
1. Accountability cannot be outsourced. Management and the board remain responsible for outcomes, regulatory compliance, data protection and reputation even when a vendor performs the work. A breach at a vendor is treated by regulators, customers and the public as a breach at the organization.
2. Expanded attack surface. Many major data breaches have started with a third party, such as an HVAC vendor with network access or a compromised software update. Every connection to a vendor is a potential entry point.
3. Concentration and dependency risk. Heavy reliance on a single provider can create a single point of failure that threatens business continuity.
4. Regulatory expectations. Banking regulators, data privacy laws such as GDPR, SOX and industry standards all require organizations to oversee their service providers.
5. Value and cost. Poorly managed contracts lead to overbilling, service-level failures, leakage of contractual rebates and unrealized savings.
6. IIA Standards alignment. The Global Internal Audit Standards require internal auditors to consider governance, risk management and control processes across the organization's extended enterprise. When planning engagements, auditors must consider the risks to the activity under review, including risks that sit with third parties.
What It Is
Third party: Any external entity that provides goods or services, or that acts on behalf of the organization. Examples include vendors, suppliers, contractors, outsourcers, distributors, agents, joint venture partners and service organizations.
Fourth party: A subcontractor of your third party. Your vendor's vendor creates indirect risk that you often do not see.
Third-party risk management (TPRM): The framework of policies, processes and controls for managing third-party risk across the whole relationship lifecycle.
Key Risk Categories
1. Strategic risk: The vendor's actions are not aligned with the organization's objectives, or outsourcing results in loss of core competencies.
2. Operational risk: Service failures, poor quality, missed service-level agreements (SLAs) or process errors.
3. Financial risk: Vendor insolvency, overbilling, fraud or unfavorable pricing.
4. Compliance and legal risk: Violations of laws such as anti-bribery rules (FCPA, UK Bribery Act), privacy rules, labor laws and sanctions, or breaches of contract.
5. Information security and privacy risk: Unauthorized access to, or loss or misuse of, confidential data.
6. Reputational risk: Vendor misconduct, such as unethical labor practices, that damages the organization's brand.
7. Business continuity and resilience risk: Vendor disruption from disasters, cyberattacks or pandemics.
8. Concentration risk: Over-reliance on one vendor or one geographic region.
9. Country or geopolitical risk: Offshore vendors affected by political instability or legal differences.
10. Fourth-party risk: Risks from subcontractors that are not visible to the organization.
11. Exit and transition risk: Difficulty bringing a process back in-house or moving it to a new vendor.
How It Works: The Third-Party Lifecycle and Key Controls
1. Planning and strategy
The organization decides whether to outsource, using a business case and risk assessment, and defines its risk appetite for outsourcing.
Controls: Board-approved outsourcing policy, cost-benefit analysis, and identification of critical activities.
2. Due diligence and selection
The organization evaluates potential vendors on financial stability, reputation, security posture, compliance history, insurance, capacity, ownership (beneficial owners, sanctions screening) and subcontracting arrangements.
Controls: Competitive bidding, vendor questionnaires, background checks, financial statement analysis, site visits, and review of independent assurance reports.
3. Contract negotiation
The contract is the main control tool. Key clauses include:
- Scope of services and SLAs or key performance indicators (KPIs)
- Right-to-audit clause, which lets the organization or its internal auditors audit the vendor
- Confidentiality, data protection and data ownership
- Security requirements and breach notification timelines
- Subcontracting restrictions and approval rights
- Business continuity and disaster recovery obligations
- Indemnification, liability limits and insurance
- Pricing, invoicing and dispute resolution
- Termination and exit provisions, including data return or destruction
- Compliance with laws and the organization's code of conduct
4. Onboarding
The organization sets up the vendor in its systems.
Controls: Segregation of duties in the vendor master file, validation of bank details, least-privilege access provisioning, and a defined relationship owner.
5. Ongoing monitoring
The organization tracks vendor performance and risk throughout the relationship.
Controls: SLA scorecards, periodic business reviews, invoice verification against the contract, periodic reassessment based on risk tier, continuous monitoring (financial alerts, adverse media, cyber ratings), review of SOC reports, and access recertification.
6. Termination and exit
The organization ends the relationship in a controlled way.
Controls: Exit plans, timely revocation of access, return or certified destruction of data, knowledge transfer, and final settlement of accounts.
Risk Tiering
Not all vendors need the same oversight. Organizations classify vendors (for example as critical, high, medium or low) based on:
- Access to sensitive data or systems
- Criticality to operations
- Spend level
- Regulatory impact
- Substitutability
Higher tiers receive deeper due diligence, more frequent monitoring and on-site audits.
Assurance Over Service Organizations: SOC Reports
Service Organization Control (SOC) reports are issued under AICPA SSAE 18, with ISAE 3402 as the international equivalent.
- SOC 1: Covers controls relevant to the user entity's internal control over financial reporting, for example a payroll processor.
- SOC 2: Covers controls related to the Trust Services Criteria, which are security, availability, processing integrity, confidentiality and privacy. It is intended for informed users.
- SOC 3: A general-use summary of SOC 2 with less detail.
- Type I: Assesses the design (and implementation) of controls at a point in time.
- Type II: Assesses design and operating effectiveness over a period, usually 6 to 12 months. It provides stronger assurance.
When relying on a SOC report, the auditor should check four things:
1. The report covers the relevant services, systems and period. Gaps between the report period and the organization's period may require a bridge letter.
2. The opinion is unqualified, and exceptions and their impact are understood.
3. Subservice organizations are identified and handled using either the carve-out or inclusive method.
4. Complementary User Entity Controls (CUECs) are in place and operating at the organization itself. This point is frequently tested.
Internal Audit's Role in Engagement Planning
When planning an engagement involving third parties, the internal auditor should:
1. Understand the outsourced process, the objectives, and how the vendor fits into the end-to-end process.
2. Review the contract, SLAs and the right-to-audit clause to determine what access exists.
3. Identify inherent risks and the organization's retained controls, including vendor governance, monitoring and CUECs.
4. Determine the sources of assurance available, such as SOC reports, vendor internal audit results, certifications (ISO 27001, PCI DSS) and regulatory exams. Applying the coordination and reliance principles, the auditor evaluates the competence, objectivity and scope of these providers.
5. Decide the scope. Options include auditing the organization's TPRM program, auditing a specific vendor on-site (if a right to audit exists), relying on a SOC report, or combining these.
6. Consider resources, such as specialized IT or cyber skills, travel and language needs.
7. Communicate with management and the vendor about access, timing and confidentiality.
Common Control Weaknesses Auditors Find
- No complete inventory of third parties
- Missing or weak right-to-audit and security clauses
- Due diligence performed only at onboarding and never refreshed
- SOC reports collected but not reviewed, and CUECs not implemented
- Undefined relationship owners
- Vendor access not removed after termination
- Invoices paid without checking them against contract terms
- No exit or contingency plan for critical vendors
- Unmonitored fourth parties
Exam Tips: Answering Questions on Third-Party Process Risks and Controls
Tip 1: Accountability stays with the organization. If an option suggests that outsourcing transfers responsibility for risk or compliance to the vendor, it is almost always wrong. Risk can be shared or mitigated through contracts and insurance, but accountability cannot be outsourced.
Tip 2: The contract is the foundation. When asked about the most important or first control for enabling audit or oversight of a vendor, look for the right-to-audit clause or well-defined contractual terms such as SLAs, security requirements and breach notification.
Tip 3: Know the SOC distinctions. SOC 1 is for financial reporting, SOC 2 is for security and privacy (the Trust Services Criteria), and SOC 3 is for general public use. Type II, which tests operating effectiveness over a period, gives more assurance than Type I, which covers design at a point in time. If a question asks which report best supports reliance on operating effectiveness, choose Type II.
Tip 4: Remember CUECs. A clean SOC report does not mean full assurance. The organization must implement complementary user entity controls. Questions often ask what the auditor should do next after receiving a SOC report. Evaluating the CUECs and the exceptions is a strong answer.
Tip 5: Think lifecycle. Map the question to the relevant lifecycle stage (due diligence, contracting, onboarding, monitoring or termination) and pick the control that fits that stage. For example, revoking access belongs to termination, and financial stability review belongs to due diligence.
Tip 6: Risk-based thinking. The best answer usually prioritizes high-risk or critical vendors, such as those with access to sensitive data or those critical to operations, rather than auditing all vendors equally or focusing on the highest spend alone.
Tip 7: Planning comes before testing. In engagement planning questions, the first steps are understanding the process, reviewing the contract and existing assurance, and assessing risk. Avoid options that jump straight to substantive testing.
Tip 8: Evaluate reliance properly. Before relying on a vendor's internal auditors or an external SOC auditor, assess their competence, objectivity and scope. Reliance is never automatic.
Tip 9: Watch for fourth parties and concentration risk. Scenario questions may hide a subcontractor or a single-source dependency. Recognize these as distinct risks.
Tip 10: Detective versus preventive controls. Due diligence and contract clauses are preventive. SLA monitoring, invoice reviews and performance scorecards are detective. Identify which type the question asks for.
Tip 11: Be wary of extreme answers. Options using words like eliminates, always or guarantees are usually wrong. Controls provide reasonable assurance, not absolute assurance.
Tip 12: Look for the gap in the period. If the SOC report period does not cover the organization's fiscal year end, the correct response often involves obtaining a bridge letter or performing additional procedures.
Sample Question Walkthrough
An organization outsources payroll to a service provider. The internal auditor obtains an unqualified SOC 1 Type II report covering nine months of the fiscal year. Which action is MOST appropriate?
Here is the reasoning:
1. The report is relevant to financial reporting (SOC 1) and tests operating effectiveness (Type II), so it is suitable.
2. However, it covers only nine of twelve months, which leaves a period gap.
3. The auditor must also verify that the organization's own CUECs, such as reviewing payroll change reports, are operating.
The best answer is: obtain a bridge letter or perform additional procedures for the uncovered period, and test the relevant CUECs.
Summary
Third-party process risks arise whenever external parties perform activities on the organization's behalf. Effective management relies on four elements:
1. A lifecycle approach covering planning, due diligence, contracting, onboarding, monitoring and exit
2. Risk-based tiering of vendors
3. Strong contractual protections, especially the right to audit
4. Independent assurance such as SOC reports, combined with the organization's own complementary controls
For the CIA exam, remember these core ideas: accountability stays in-house, the contract enables oversight, SOC report types matter, CUECs are essential, and engagement planning starts with understanding the process, reviewing the contract and assessing risk.
