Third-Party, Outsourcing and Supply Chain Risk Assurance Training Course

Course Introduction

Third-party, outsourcing and supply chain relationships can create significant operational, financial, regulatory, technology, cybersecurity, reputational, and strategic exposures when organisations depend on external parties to deliver critical products and services. This course provides a structured approach to auditing and assuring third-party ecosystems, helping professionals evaluate whether external dependencies are appropriately governed, assessed, monitored, controlled, and integrated into the organisation's overall risk management framework.

The Third-Party, Outsourcing and Supply Chain Risk Assurance Training Course examines the complete third-party risk assurance lifecycle, from relationship identification and due diligence through contracting, onboarding, ongoing monitoring, performance management, incident response, renewal, exit, and termination. Participants will develop practical techniques for evaluating whether third-party risk management processes provide sufficient visibility over suppliers, vendors, contractors, outsourced service providers, strategic partners, and other external relationships.

Effective third-party assurance requires more than reviewing contracts or supplier questionnaires. Auditors need to understand the nature and criticality of the services provided, dependencies between parties, concentration risks, subcontracting arrangements, control environments, information flows, geographic exposure, resilience capabilities, and potential consequences of third-party failure. The programme therefore integrates risk assessment, control evaluation, supplier due diligence, contract assurance, performance monitoring, and evidence-based testing.

The course also addresses outsourcing and supply chain arrangements involving cloud providers, technology vendors, logistics providers, professional service firms, manufacturers, agents, labour providers, and other strategic partners. Participants will examine how organisations can assess service-level performance, information security, privacy, business continuity, financial stability, regulatory compliance, ethical conduct, environmental responsibilities, and other risk dimensions within extended enterprise relationships.

Modern supply chains are increasingly interconnected and vulnerable to disruption from cyber incidents, geopolitical developments, climate events, economic volatility, technological dependencies, labour shortages, concentration, and fourth-party relationships. The programme therefore addresses emerging risks including fourth-party risk, software and technology supply chains, artificial intelligence providers, cloud concentration, critical infrastructure dependencies, digital ecosystems, sustainability expectations, and systemic supply chain vulnerabilities.

By completing this programme, participants will be equipped to provide robust, risk-based assurance over third-party and supply chain arrangements. The course strengthens due diligence assessment, contract and control review, supplier risk analytics, resilience evaluation, audit evidence, stakeholder communication, and remediation follow-up, enabling organisations to improve oversight of external relationships while maintaining appropriate accountability for risks that remain within the organisation's responsibility.

Duration

10 days

Who Should Attend

• Internal auditors responsible for third-party, outsourcing, vendor, supplier, and supply chain risk assurance.

• Third-party risk management professionals responsible for supplier identification, assessment, monitoring, and governance.

• Procurement professionals involved in supplier selection, due diligence, contracting, performance management, and vendor oversight.

• Supply chain managers responsible for supplier resilience, operational continuity, sourcing strategies, and supply chain risk.

• Outsourcing and vendor management professionals overseeing external service providers and strategic outsourcing arrangements.

• Enterprise risk managers assessing external dependencies, concentration risks, operational exposures, and third-party resilience.

• Compliance professionals monitoring regulatory, contractual, ethical, and legal obligations associated with third-party relationships.

• Information security and cybersecurity professionals assessing technology suppliers, cloud providers, and outsourced technology risks.

• Business continuity and resilience professionals evaluating supplier continuity, recovery capability, and critical external dependencies.

• Legal and contract management professionals responsible for third-party agreements, obligations, liability, service levels, and termination arrangements.

• Finance professionals assessing supplier financial stability, payment risks, commercial exposures, and third-party financial controls.

• ESG and sustainability professionals evaluating responsible sourcing, supplier environmental performance, labour practices, and sustainability risks.

• Governance and assurance professionals supporting boards, audit committees, risk committees, and management with third-party oversight.

• Consultants and assurance professionals conducting supplier risk assessments, outsourcing reviews, supply chain audits, and third-party control evaluations.

Course Objectives

• Develop an advanced understanding of third-party, outsourcing, and supply chain risk assurance principles, governance expectations, risk frameworks, audit methodologies, and professional responsibilities.

• Identify and assess external relationships that create material operational, financial, regulatory, technology, cybersecurity, reputational, strategic, and resilience risks for the organisation.

• Apply risk-based third-party audit planning techniques to prioritise critical suppliers, outsourced services, strategic vendors, high-risk relationships, and concentrated dependencies.

• Evaluate supplier due diligence processes covering ownership, financial stability, compliance, cybersecurity, operational capability, reputation, resilience, ethics, and other relevant risk dimensions.

• Assess the design and operating effectiveness of third-party governance frameworks, policies, procedures, responsibilities, approval processes, risk classification, and monitoring arrangements.

• Audit third-party contracts, service-level agreements, performance requirements, control obligations, audit rights, reporting provisions, incident notification, liability, and exit arrangements.

• Evaluate third-party control environments using documentation reviews, assurance reports, interviews, site visits, performance evidence, control testing, data analytics, and other appropriate audit procedures.

• Assess outsourcing and supply chain resilience by examining critical dependencies, concentration risks, subcontractors, fourth parties, alternative suppliers, recovery capabilities, and disruption preparedness.

• Analyse supplier performance, incidents, complaints, service-level exceptions, risk indicators, financial information, compliance events, and other data to identify deteriorating third-party risk.

• Apply root cause analysis and professional judgement when evaluating supplier deficiencies, distinguishing isolated performance issues from systemic weaknesses in governance, contracting, oversight, or risk management.

• Develop clear audit findings and recommendations that communicate third-party exposures, control deficiencies, root causes, consequences, accountability, and practical remediation priorities.

• Strengthen continuous third-party assurance through risk monitoring, supplier analytics, integrated assurance, emerging-risk assessment, technology-enabled oversight, remediation follow-up, and dynamic risk reassessment.

Comprehensive Course Outline

Module 1: Foundations of Third-Party and Supply Chain Risk Assurance

• Principles, objectives, scope, benefits, professional responsibilities, and assurance concepts associated with third-party and supply chain risk auditing.

• The relationship between external dependencies, outsourcing, supplier risk, operational risk, enterprise risk management, resilience, and organisational performance.

• Categories of third parties including suppliers, contractors, agents, vendors, outsourced providers, strategic partners, technology providers, and service intermediaries.

• Audit independence, objectivity, professional scepticism, confidentiality, competence, professional judgement, and quality considerations in third-party assurance.

Module 2: Third-Party Risk Governance and Management Frameworks

• Third-party governance structures, board and management oversight, accountability, risk ownership, committees, policies, procedures, and escalation mechanisms.

• Third-party risk management lifecycle covering identification, classification, assessment, selection, onboarding, monitoring, renewal, remediation, and exit.

• Integration of third-party risk management with enterprise risk management, procurement, legal, information security, compliance, business continuity, and internal audit.

• Establishing audit criteria using organisational policies, regulatory expectations, contractual requirements, risk frameworks, industry practices, and management commitments.

Module 3: Third-Party Risk Identification, Assessment and Audit Planning

• Identification of third-party relationships, critical services, material dependencies, sensitive activities, strategic suppliers, and high-risk outsourcing arrangements.

• Risk-based third-party audit planning, including audit universe development, engagement objectives, scope, criteria, sampling, resources, timelines, and detailed audit programmes.

• Supplier risk classification based on criticality, data access, operational dependency, financial exposure, geographic location, regulatory significance, and potential business impact.

• Preliminary risk profiling, stakeholder engagement, supplier intelligence, previous incidents, performance history, assurance reports, and development of focused audit procedures.

Module 4: Supplier Due Diligence and Onboarding Controls

• Supplier due diligence processes covering ownership, financial health, reputation, legal standing, compliance history, operational capability, and relevant risk factors.

• Assessment of onboarding controls, supplier approvals, risk classification, documentation requirements, screening, conflict-of-interest checks, and management authorisation.

• Evaluation of enhanced due diligence for high-risk suppliers, critical service providers, politically exposed relationships, sensitive activities, and complex ownership structures.

• Auditing due diligence refresh processes, trigger events, information updates, exceptions, incomplete assessments, and management responses to identified concerns.

Module 5: Contracting, Service Levels and Third-Party Control Requirements

• Auditing contracts for clear service descriptions, performance requirements, responsibilities, control obligations, reporting, confidentiality, security, compliance, and risk allocation.

• Service-level agreements, key performance indicators, service credits, performance thresholds, escalation arrangements, monitoring, and evidence supporting supplier accountability.

• Contract provisions covering audit rights, access to information, incident notification, regulatory cooperation, subcontracting, data protection, business continuity, and termination.

• Evaluation of contract governance, approval controls, renewal processes, variations, exceptions, unresolved obligations, and alignment between contractual terms and actual operating practices.

Module 6: Third-Party Operational and Performance Risk

• Auditing supplier operational performance, service delivery, quality, capacity, availability, timeliness, customer outcomes, and adherence to agreed requirements.

• Evaluation of supplier performance monitoring, key performance indicators, management information, exception reporting, complaints, incidents, and corrective action processes.

• Assessment of critical service dependencies, operational bottlenecks, capacity constraints, single points of failure, and supplier capability limitations.

• Root cause analysis of recurring service failures, performance deterioration, contract breaches, and unresolved supplier deficiencies affecting organisational objectives.

Module 7: Outsourcing Risk and External Service Provider Assurance

• Governance and risk considerations associated with outsourcing critical, regulated, technology-enabled, operational, and specialist business functions.

• Evaluation of outsourcing business cases, risk assessments, control responsibilities, transition arrangements, service dependencies, retained risks, and management accountability.

• Auditing outsourced processes through service reports, assurance evidence, performance data, control testing, walkthroughs, site reviews, and direct stakeholder interviews.

• Assessment of exit strategies, service transition, data return, knowledge transfer, operational continuity, replacement providers, and termination risks within outsourcing arrangements.

Module 8: Third-Party Technology, Cybersecurity and Data Risk

• Cybersecurity risks associated with suppliers, cloud providers, SaaS platforms, managed services, technology vendors, application providers, and digital ecosystems.

• Assessment of third-party access controls, privileged access, authentication, data security, encryption, vulnerability management, logging, incident response, and security monitoring.

• Auditing third-party privacy and data protection controls involving personal, confidential, financial, operational, and commercially sensitive information.

• Evaluation of technology assurance reports, security assessments, penetration testing evidence, incident histories, control certifications, and remediation of identified weaknesses.

Module 9: Supply Chain Resilience, Continuity and Concentration Risk

• Identification of critical supply chain dependencies, single-source suppliers, geographic concentration, logistics constraints, infrastructure reliance, and other continuity vulnerabilities.

• Auditing supplier business continuity, disaster recovery, crisis management, backup arrangements, alternative sourcing, inventory strategies, and recovery capabilities.

• Evaluation of supply chain stress testing, disruption scenarios, resilience exercises, lessons learned, recovery performance, and management responses to identified weaknesses.

• Assessment of concentration, systemic dependency, common suppliers, shared infrastructure, fourth-party exposure, and interconnected supply chain risks.

Module 10: Fourth-Party and Extended Supply Chain Risk

• Identification and assessment of subcontractors, sub-processors, fourth parties, logistics partners, technology dependencies, and other indirect relationships supporting critical services.

• Auditing third-party oversight of subcontractors, including due diligence, contractual flow-down requirements, monitoring, approvals, performance controls, and incident reporting.

• Evaluation of visibility limitations, hidden dependencies, concentration risks, geographic exposure, and control weaknesses within extended supply chain networks.

• Techniques for assessing whether primary suppliers effectively manage their own external dependencies and provide sufficient transparency over material fourth-party risks.

Module 11: Third-Party Compliance, Ethics and Sustainability Risk

• Auditing supplier compliance with legal, regulatory, contractual, ethical, labour, environmental, human rights, and organisational requirements.

• Evaluation of third-party codes of conduct, anti-bribery controls, conflicts of interest, sanctions screening, whistleblowing arrangements, and ethical due diligence.

• Sustainability and responsible sourcing risks involving environmental impacts, labour practices, human rights, modern slavery, resource use, and supplier transparency.

• Assessment of third-party compliance incidents, allegations, regulatory actions, environmental events, labour concerns, and management responses to identified issues.

Module 12: Third-Party Risk Data Analytics and Continuous Monitoring

• Third-party risk data sources including supplier registers, contracts, performance records, incidents, financial information, assurance reports, risk assessments, and compliance data.

• Use of analytics to identify supplier concentration, unusual performance patterns, repeated incidents, overdue assessments, control exceptions, contract gaps, and emerging risk indicators.

• Development of key risk indicators and dashboards for monitoring supplier health, critical dependencies, performance deterioration, incidents, resilience, and remediation status.

• Continuous monitoring, automated supplier intelligence, technology-enabled risk sensing, integrated assurance, and data-driven approaches to third-party oversight.

Module 13: Supplier Financial, Commercial and Strategic Risk

• Assessment of supplier financial health, liquidity, solvency, credit exposure, dependency, pricing pressures, and potential financial distress affecting critical services.

• Auditing supplier pricing, billing, payment, contract variation, cost escalation, service credits, rebates, and commercial control arrangements.

• Evaluation of strategic supplier dependency, market concentration, supplier lock-in, intellectual property reliance, specialised capability, and replacement difficulty.

• Scenario analysis for supplier failure, financial distress, market disruption, acquisition, withdrawal, insolvency, or major changes in supplier capability.

Module 14: Emerging Third-Party and Supply Chain Risks

• Artificial intelligence providers, automated services, cloud concentration, software supply chains, digital platforms, data ecosystems, and emerging technology dependencies.

• Geopolitical disruption, trade restrictions, climate-related events, resource scarcity, cyber supply chain threats, and infrastructure dependencies affecting external relationships.

• Sustainability expectations, supply chain transparency, responsible sourcing, environmental disruption, human rights concerns, and changing stakeholder requirements.

• Systemic third-party risk, interconnected supplier networks, concentration vulnerabilities, cascading failures, and advanced scenario analysis for future supply chain resilience.

Module 15: Third-Party Audit Reporting, Remediation and Follow-Up

• Developing evidence-based third-party audit findings that clearly communicate criteria, condition, cause, consequence, risk significance, and supporting evidence.

• Writing practical recommendations addressing governance, due diligence, contracting, monitoring, performance, resilience, cybersecurity, compliance, and supplier oversight weaknesses.

• Communicating significant third-party exposures to boards, audit committees, executives, procurement leaders, risk committees, technology leaders, and operational stakeholders.

• Follow-up auditing, remediation verification, residual-risk assessment, overdue-action escalation, supplier improvement plans, and evaluation of sustained control effectiveness.

Module 16: Advanced Third-Party Risk Assurance Strategy

• Integrating third-party assurance with enterprise risk management, internal audit strategy, procurement governance, operational resilience, cybersecurity, compliance, and business continuity.

• Developing dynamic third-party audit plans based on supplier criticality, risk indicators, incidents, performance trends, organisational changes, emerging risks, and assurance history.

• Advanced assurance approaches involving continuous monitoring, supplier analytics, integrated assurance, automated risk assessment, external intelligence, and technology-enabled control testing.

• Building a forward-looking third-party assurance strategy focused on transparency, resilience, concentration management, accountability, extended-enterprise visibility, and continual risk improvement.

Training Approach

This course will be delivered by our skilled trainers who have vast knowledge and experience as expert professionals in the fields. The course is taught in English and through a mix of theory, practical activities, group discussion and case studies. Course manuals and additional training materials will be provided to the participants upon completion of the training.

Tailor-Made Course

This course can also be tailor-made to meet organization requirement. For further inquiries, please contact us on: Email: training@upskilldevelopment.com Tel: +254 721 331 808

Training Venue 

The training will be held at our Upskill Training Centre. We also offer training for a group (at a discount of 10% to 50%) at requested location all over the world. The Onsite course fee covers the course tuition, training materials, two break refreshments, buffet lunch, airport transfers, Upskill gift package, and guided tour.

Visa application, travel expenses, dinners, accommodation, insurance, and other personal expenses are catered by the participant

Certification

Participants will be issued with Upskill certificate upon completion of this course.

Airport Pickup and Accommodation

Airport pickup and accommodation is arranged upon request. For booking contact our Training Coordinator through Email: training@upskilldevelopment.com, +254 721 331 808

Terms of Payment:

Unless otherwise agreed between the two parties’ payment of the course fee should be done 3 working days before commencement of the training so as to enable us to prepare better.