Introduction
A major payment processor goes down. The board convenes. Someone asks when that vendor was last audited — and nobody has a clean answer. The vendor had access to core systems, processed customer transactions, and had been renewing contracts for years without a formal control assessment.
This scenario plays out more often than boards realize. And the exposure isn't just operational. According to Verizon's 2024 Data Breach Investigations Report, 15% of confirmed breaches involved a third party — a 68% increase from the prior year, across a dataset of over 30,000 incidents.
The accountability gap is real: organizations rely on third parties for cloud infrastructure, payment processing, logistics, and IT support, but when something goes wrong in those vendor environments, the liability stays with the organization. Internal audit is the function best positioned to close that gap. Most TPRM programs, however, are not structured to let it.
This post covers what internal audit's role in TPRM actually looks like across the vendor lifecycle and where most programs fall short. It also sets out what boards should expect to see as evidence of real oversight.
TL;DR
- Third-party breaches rose 68% year-over-year — vendor oversight is a board-level governance issue, not just a procurement task.
- Internal audit's role is independent assurance — the risk team owns the TPRM program; audit validates that it works.
- Effective oversight spans the full vendor lifecycle: due diligence, onboarding, ongoing monitoring, and offboarding.
- The most common gaps — missing vendor inventories, one-time assessments, and findings never translated into business impact — are the ones that surface during incidents.
- Escalation paths to the audit committee need to be direct, documented, and tested before an incident forces the question.
Why Third-Party Risk Has Escalated to a Board-Level Concern
Organizations that once managed a handful of critical vendors now operate across dozens of SaaS platforms, cloud environments, and outsourced functions — each one a potential entry point for a breach they don't directly control.
Gartner projects that 75% of enterprises will prioritize SaaS application backup as a critical requirement by 2028, compared to just 15% in 2024. Meanwhile, Deloitte's 2024 outsourcing survey found that 80% of executives plan to maintain or increase investment in third-party outsourcing. The exposure profile keeps growing.
The Fourth-Party Blind Spot
What boards rarely see represented in their risk reporting is fourth-party exposure. Your vendors have their own vendors, and a compromise downstream can cascade upstream with no warning. The MOVEit vulnerability illustrates this directly: it appeared in 1,567 breach notifications in Verizon's 2024 DBIR, affecting organizations that had no direct relationship with the compromised software.
The question boards should be asking: does your TPRM program require critical vendors to disclose their material subcontractor relationships?
Regulatory Expectations Have Hardened
Frameworks no longer treat third-party due diligence as good practice. They treat it as mandatory:
- NIST CSF 2.0 (February 2024) requires that suppliers are prioritized by criticality, due diligence is performed before relationships begin, and post-relationship provisions are planned.
- OCC/FDIC/Federal Reserve interagency guidance (June 2023) defines a full lifecycle — planning, due diligence, contract negotiation, ongoing monitoring, and termination — with board reporting requirements attached.
- GDPR requires demonstrable processor compliance under Article 28.
- HIPAA requires written assurances from business associates.
- DORA (EU 2022) mandates that financial entities manage ICT third-party risk as an integral part of their overall risk framework.
Periodic check-ins no longer satisfy these expectations. Regulators have moved from guidance to enforcement — and internal audit is now expected to verify that the organization can demonstrate compliance, not just describe its intentions.
The Internal Audit Function's Defined Role in Third-Party Risk Management
The three lines of defense exist for a reason — internal audit occupies a specific one. Conflating the lines is one of the most common governance failures boards tolerate.
- First line (business owners, procurement): owns vendor relationships and manages them day-to-day.
- Second line (risk management, compliance): sets TPRM policy, monitors adherence, and escalates issues.
- Third line (internal audit): provides independent assurance that the first two lines are actually working.
Internal audit does not run the TPRM program. The IIA's Three Lines Model is explicit: internal audit provides independent and objective assurance on governance and risk management , separate from management by design. In practice, that means evaluating whether the program is designed appropriately, operating as intended, and aligned to the organization's actual risk appetite — not just whether documentation exists.
Identifying Critical Third Parties for Audit Focus
Not every vendor deserves the same scrutiny. Internal audit should prioritize vendors based on:
- Access to sensitive or regulated data
- Embeddedness in critical operations
- Regulatory obligations attached to the relationship
- Potential business disruption if the vendor fails
A flat vendor inventory reviewed at uniform frequency is a reliable indicator of an immature program. Risk tiering isn't optional ; it's the mechanism that makes oversight proportionate and defensible.
Assessing Governance and Program Design
Internal audit should evaluate whether the TPRM governance model (centralized, federated, or decentralized) matches the organization's structure and risk profile. Specific indicators of weak operational integrity include:
- Risk exceptions approved informally with no expiry date
- No single accountable owner for the TPRM program
- Metrics that shift each reporting cycle, preventing trend formation
- No documented escalation path when vendor issues cross authority levels
- Assurance activities that rely solely on management self-reporting
Evaluating Controls and Contract Provisions
Contract quality is foundational. Internal audit should verify that vendor agreements include:
- Right-to-audit clauses that are enforceable, not just present
- Data handling and breach notification requirements with specific timeframes (not vague language like "reasonable time")
- SLA accountability with defined remedies
- Subcontractor flow-down and approval requirements for material changes
When these provisions are missing or vague, the organization loses its ability to investigate and remediate vendor failures — no matter how sophisticated the monitoring program around them.
How Internal Audit Operates Across the TPRM Lifecycle
Point-in-time reviews are no longer sufficient. NIST, OCC, and ISACA all define third-party risk management as a lifecycle discipline — and internal audit's scope should reflect that.
| Lifecycle Phase | What Internal Audit Validates |
|---|---|
| Due Diligence / Selection | Risk-tiered screening, documented exceptions, subcontractor review |
| Contract & Onboarding | Entry criteria met, right-to-audit present, security obligations confirmed |
| Ongoing Monitoring | Assessment frequency tied to risk tier, open findings tracked |
| Offboarding / Termination | Access revoked, data returned or destroyed, formal sign-off documented |
Vendor Profiling and Due Diligence
Before a vendor is onboarded, internal audit should validate that the selection process applied risk-tiered scrutiny. Higher-risk vendors — those handling regulated data or embedded in critical operations — require deeper review of security posture, financial stability, compliance history, and subcontractor relationships.
Exceptions to this process should be documented and approved at appropriate authority levels. Undocumented exceptions are a finding. Undocumented exceptions for high-risk vendors are a material finding.
Contract Negotiation and Onboarding
Internal audit's entry-point check: were contractual obligations met before the vendor was given access? A right-to-audit clause is the minimum standard — its absence makes meaningful vendor oversight functionally impossible.
Ongoing Monitoring
High-risk vendors warrant continuous monitoring signals: security ratings, incident notifications, SLA performance trends. Lower-risk vendors may be assessed biennially, with trigger-based exceptions when scope changes materially or an incident occurs.
Applying a uniform schedule across all vendor tiers signals a governance gap, not a functioning program.
Offboarding
Offboarding is the phase most likely to have no process at all. Internal audit should verify:
- A documented offboarding checklist exists and is followed
- Access revocation is confirmed (not just requested)
- Data return or destruction is evidenced
- Formal sign-off is on file
Legacy vendor relationships with no offboarding records are a common audit finding — and a real security exposure.
Common Gaps That Leave Boards Exposed
Most boards discover TPRM gaps after a vendor incident has already occurred. The structural weaknesses that enable this tend to follow recognizable patterns.
No Centralized Vendor Inventory
NIST CSF 2.0 (GV.SC-04) requires that suppliers be known and prioritized by criticality. When vendor relationships originate across procurement, IT, finance, and individual business units with no unified registry, internal audit is working from an incomplete picture.
The absence of a centralized inventory should be treated as a control gap on its own: not a prerequisite to be resolved before oversight begins, but a finding that demands immediate attention.
The Continuous Monitoring Gap
Inventory gaps make continuous monitoring harder. Annual-only assessments leave windows of undetected risk when a vendor's security posture, financial health, or regulatory standing changes between review cycles. NIST GV.SC-07 expects risks to be recorded, assessed, responded to, and monitored over the relationship — not reviewed once at onboarding and filed.
The MOVEit breach makes this concrete. Organizations that assessed that vendor in January of a given year had no mechanism to detect the vulnerability that emerged months later until breach notifications arrived.
Reporting That Doesn't Enable Decisions
This is the gap that costs boards the most. Internal audit findings on TPRM frequently:
- Describe risk in compliance language rather than business impact terms
- Present single-point snapshots rather than trend data
- Lack named owners and remediation timelines
- Never reach the audit committee in a form that enables a decision
Can your internal audit function answer "which of our top 20 vendors had a control failure in the last 90 days?" If not, the program is producing documentation, not oversight.
Tyson Martin's approach to this challenge maps vendor findings directly to business outcomes: not "vendor lacks MFA for admin access," but "a compromised admin account could expose customer data and disrupt operations." Directors can act on that framing. They can't act on a control checklist.
What Effective Internal Audit TPRM Oversight Looks Like from the Boardroom
Boards should approach their internal audit function's TPRM coverage with specific questions — not general assurance requests.
Questions Boards Should Be Asking
- Is there a risk-tiered vendor inventory, or is every vendor treated equally?
- Are audit cadences tied to risk level, or to the calendar?
- Are findings presented in business impact terms, with owners and remediation deadlines?
- Can internal audit tell us which critical vendors degraded since last quarter?
Escalation Thresholds and Decision Rights
Internal audit should have a defined, direct path to escalate material TPRM findings to the audit committee — not filtered through management. Boards should confirm that path exists and has been tested.
Effective escalation thresholds aren't subjective. They should be pre-defined and tied to measurable triggers:
- Amber triggers: vendor showing deteriorating performance for two consecutive cycles, rising exception counts, near-miss incidents
- Red triggers: repeat breaches, exceptions that expire without closure, regulatory notification thresholds reached
Each trigger should specify who gets notified, at what speed, and what response is expected. When these thresholds are pre-approved, organizations spend incident time solving problems rather than negotiating authority.
Decision rights must be concrete — documented in plain language before pressure hits. At minimum, organizations need clarity on who can grant policy exceptions, who accepts risk at defined levels, who declares an incident, and who owns external communications.
A simple RACI framework prevents these questions from being answered in real-time during a vendor failure.
Metrics That Signal Real Coverage
Boards should expect regular reporting to include:
- How many vendors in each risk tier have been assessed, and when
- Open findings by tier, with remediation status and aging
- Vendor risk rating trends — what moved up, down, or stayed stuck since last quarter
- Concentration risk: top five vendors by business impact, with single-point-of-failure identification
- Material incidents or near-misses presented as trend data, not one-time events
- How long risk acceptances remain open and whether they carry expiry dates
Audit-ready documentation tells the board what was reviewed. What it can't do is confirm whether the program is actually holding — that requires a reporting cadence built around trend, not transaction.
Frequently Asked Questions
What is the difference between internal audit's role and the risk management team's role in TPRM?
The second line (risk management) owns the TPRM program — it sets policy, monitors vendor adherence, and manages day-to-day oversight. The third line (internal audit) provides independent assurance that the program is designed appropriately and operating effectively. They are complementary functions, not interchangeable ones.
How often should internal audit review third-party vendors?
Frequency should follow risk tier: critical and high-risk vendors warrant annual or continuous monitoring; medium-risk vendors may be reviewed biennially. All tiers should also have trigger-based reviews when vendor scope changes materially, incidents occur, or performance degrades.
What are the biggest red flags internal audit should look for in a vendor relationship?
Key indicators include: absence of a right-to-audit clause, undocumented access privileges, missing or outdated security certifications, no defined offboarding process, and vendors that predate current security standards with unclear relationship ownership.
How should boards evaluate whether their internal audit TPRM function is effective?
Ask whether findings are risk-tiered, escalation paths to the audit committee are documented, and reporting conveys business impact and trend — not just compliance status. A program that cannot identify which critical vendors degraded last quarter is not giving the board what it needs.
What frameworks should internal audit use when assessing third-party risk?
NIST CSF 2.0, ISO 27001:2022, and COBIT 2019 are the most-used starting points. The key is selecting one consistently: controls can then be compared across vendors and tracked over time, rather than re-baselined with each engagement.
How does fourth-party risk factor into internal audit's TPRM responsibilities?
Internal audit should verify that the TPRM program requires critical vendors to disclose and manage their own third-party relationships, and that material fourth-party exposures are surfaced in assessments. The focus belongs on critical vendors' key subprocessors — not an attempt to map every downstream dependency.
