Audit Readiness is an Operational Discipline

If your third-party risk management program has existed for more than a couple of years, you know that audits and examinations no longer qualify as occasional interruptions. External auditors, internal auditors, regulatory examiners, and other external specialists are asking more frequent, and more detailed questions about how you govern, monitor, and document your organization’s relationships with third parties. Shared Assessments’ white paper, Preparing for Audits & Examinations, provides a comprehensive look at how audit ready TPRM programs respond to this scrutiny. Here, I want to focus on the specific actions that TPRM teams should perform before, during, and after an audit or examination.

Taking the right steps is only part of the equation. TPRM teams also need to cultivate a mindset of continuous audit readiness. Many TPRM teams still treat audits as one-time events, triggering a reactive scramble once the entrance memo arrives. That approach can be both risk and costly. Poor preparation can make it harder to demonstrate that your program and controls are working as intended and can contribute to more audit findings. Those can create additional challenges: more frequent and more demanding audits, board-level questions about the TPRM program’s credibility, and great regulatory scrutiny and potential enforcement actions, consent orders, and penalties in regulated industries.

The benefits of audit readiness also have a way of multiplying. Audit-ready TPRM programs give their C-suites and boards assurance that the organization is managing third-party risk effectively. They use audits to identify unclear documentation, process gaps, and control weaknesses that might otherwise go unnoticed. Audit findings can even help TPRM teams build compelling cases for investments in headcount and technology. And when teams are organized, responsive, and transparent, they can build more productive and collaborative relationships with auditors and examiners that improve the efficiency of future engagements.

TPRM professionals like to remind third-parties that assessments are not as intrusive as audits. TPRM teams preparing for audits and examinations of their own programs should keep the opposite in mind: audits are far more rigorous and comprehensive than a typical vendor assessment. Auditors assess the design and effectiveness of the control environment, clarifying whether a TPRM program is operating in accordance with applicable regulatory requirements, industry frameworks, and internal governance documents such as policies, standards, and procedures.

Fortunately, establishing audit readiness boils down to a set of straightforward actions across the three phases of the auditing lifecycle:

Leading Practices: Pre-Audit
◻Validate that all TPRM activities are captured in systems of record
◻Reconcile third-party inventory across procurement, accounts payable (AP), and contract systems
◻Conduct a pre-audit review, either internally or with help from an external specialist
◻Brief senior leadership on the audit’s likely focus areas, known gaps, and TPRM’s game plan
◻Tailor preparation based on the type and scope of the audit
◻Coach each team member on the best way to communicate with auditors and examiners
◻Designate a central point of contact to manage all communications and document submissions
◻Align with key stakeholders such as legal, procurement, and information security ahead of the audit
◻Run the reports auditors are most likely to request, and review them for errors, inconsistencies, or other anomalies
◻When you receive the entrance memo and document request list, organize your information and evidence to match the auditor’s filing and/or numbering system
◻Review the audit timeline; if it conflicts with critical business activities, request adjustments with the auditor as early as possible