Vendor and Third-Party Risk Auditing Training Course

Course Introduction

Organisations increasingly depend on vendors, contractors, suppliers, outsourced service providers, technology partners, consultants, agents, and other third parties to deliver essential products and services. This creates significant financial, operational, regulatory, cybersecurity, reputational, and strategic exposure. The Vendor and Third-Party Risk Auditing Training Course provides a comprehensive framework for evaluating third-party governance, risk management, due diligence, controls, contracts, performance, and ongoing assurance.

The programme examines the complete third-party lifecycle, from initial business need and vendor selection through due diligence, onboarding, contracting, service delivery, monitoring, renewal, remediation, and termination. Participants will learn practical techniques for assessing whether vendors are appropriately selected, risk-rated, authorised, contracted, monitored, and periodically reassessed according to their criticality and exposure.

Vendor due diligence receives detailed attention, including financial stability, ownership, sanctions, regulatory compliance, conflicts of interest, information security, privacy, business continuity, subcontracting, geographic exposure, operational resilience, and reputation. Participants will develop structured approaches for identifying inherent third-party risks and determining whether the organisation has implemented controls proportionate to the nature and significance of each vendor relationship.

The course also focuses on contract and performance assurance. Participants will examine service-level agreements, key performance indicators, pricing, deliverables, warranties, audit rights, data protection provisions, cybersecurity obligations, insurance, indemnities, business continuity requirements, termination rights, and subcontracting arrangements. Practical audit techniques will be applied to determine whether vendors are delivering according to contractual commitments and whether management responds effectively to identified deficiencies.

Technology and digital dependency have transformed third-party risk. Cloud providers, software vendors, managed service providers, fintech partners, data processors, artificial intelligence providers, and interconnected platforms can introduce risks that extend beyond traditional supplier management. The programme therefore incorporates cybersecurity, data privacy, access management, fourth-party risk, AI governance, cloud assurance, digital resilience, and technology-enabled third-party monitoring.

By the end of the programme, participants will be equipped to plan and conduct risk-based vendor and third-party audits, evaluate due diligence, assess contracts and controls, analyse vendor performance, identify fraud and compliance risks, review cybersecurity and privacy arrangements, assess concentration and fourth-party risks, and develop evidence-based recommendations. The course supports stronger third-party governance, resilience, accountability, regulatory compliance, and protection of organisational resources and information.

Duration

10 days

Who Should Attend

• Internal auditors responsible for vendor management, outsourcing, procurement, contracts, and third-party assurance.

• Vendor and supplier risk managers responsible for third-party risk identification, assessment, monitoring, and remediation.

• Procurement professionals involved in supplier selection, due diligence, contracting, onboarding, and vendor governance.

• Contract managers responsible for service-level agreements, supplier performance, contract compliance, and relationship management.

• Risk and compliance professionals assessing operational, regulatory, financial, technology, and third-party risks.

• Information technology auditors reviewing technology vendors, cloud providers, managed services, and digital supply-chain risks.

• Cybersecurity professionals assessing vendor security controls, access arrangements, incident management, and cyber resilience.

• Data privacy professionals reviewing third-party data processing, information-sharing, privacy controls, and regulatory obligations.

• Finance professionals auditing vendor payments, pricing, financial stability, contract expenditure, and supplier-related controls.

• Fraud examiners and investigators examining vendor fraud, conflicts of interest, collusion, kickbacks, and third-party misconduct.

• Audit committee and governance professionals overseeing outsourcing, vendor exposure, critical suppliers, and organisational resilience.

• Business continuity and operational resilience professionals assessing supplier dependencies, service continuity, and recovery arrangements.

• Public-sector professionals responsible for government suppliers, outsourced services, contractors, and third-party accountability.

• Senior managers responsible for strategic outsourcing, critical vendors, enterprise risk, and third-party governance.

Course Objectives

• Develop advanced knowledge of vendor and third-party risk auditing principles, governance frameworks, methodologies, and risk-based assurance approaches.

• Assess third-party governance structures, policies, accountability arrangements, risk ownership, oversight responsibilities, and vendor management frameworks.

• Design risk-based vendor audit programmes covering selection, due diligence, onboarding, contracting, service delivery, monitoring, renewal, and termination.

• Evaluate vendor due diligence processes covering ownership, financial stability, compliance, sanctions, reputation, cybersecurity, privacy, resilience, and operational capability.

• Assess whether third-party risks are appropriately identified, classified, rated, documented, accepted, monitored, escalated, and periodically reassessed.

• Audit vendor contracts and service-level agreements to determine whether key risks, obligations, controls, performance measures, audit rights, and termination provisions are adequately addressed.

• Evaluate third-party performance using service-level indicators, deliverables, incidents, complaints, financial information, control assessments, and management reporting.

• Identify vendor fraud and misconduct risks involving conflicts of interest, collusion, bribery, kickbacks, false invoicing, overbilling, fictitious vendors, and unauthorised relationships.

• Assess cybersecurity, data privacy, access management, cloud, technology, and digital supply-chain risks associated with external service providers and technology vendors.

• Evaluate subcontracting, fourth-party relationships, vendor concentration, geographic dependency, critical service providers, and other extended third-party risks.

• Develop clear audit findings and practical recommendations addressing root causes, control weaknesses, contractual gaps, performance deficiencies, financial exposure, and risk acceptance.

• Establish continuous third-party assurance through risk indicators, automated monitoring, vendor intelligence, periodic reassessment, analytics, control testing, and emerging-risk analysis.

Comprehensive Course Outline

Module 1: Foundations of Vendor and Third-Party Risk Auditing

• Principles, objectives, scope, methodologies, and professional responsibilities of third-party risk auditing.

• The third-party lifecycle from business need and vendor selection through due diligence, contracting, monitoring, renewal, and termination.

• Major third-party risks involving financial loss, service disruption, regulatory breaches, cyber incidents, data exposure, fraud, and reputational damage.

• Professional skepticism, audit independence, confidentiality, evidence requirements, ethical conduct, and appropriate third-party audit judgment.

Module 2: Third-Party Governance, Policies and Risk Frameworks

• Third-party governance structures, policies, accountability arrangements, risk ownership, approval authorities, and oversight responsibilities.

• Roles of procurement, business owners, risk management, legal, compliance, information security, finance, internal audit, and senior management.

• Vendor risk classification frameworks based on criticality, spend, data access, service dependency, regulatory exposure, and operational impact.

• Third-party control frameworks, risk appetite, exception management, escalation procedures, management reporting, and governance committees.

Module 3: Vendor Risk Assessment and Audit Planning

• Identification and assessment of inherent, residual, financial, operational, compliance, cyber, privacy, resilience, fraud, and strategic vendor risks.

• Risk-based selection of vendors, contracts, services, transactions, and relationships for detailed audit attention.

• Development of vendor audit objectives, scope, criteria, sampling methods, testing procedures, evidence requirements, and audit timelines.

• Incorporating incidents, complaints, vendor performance issues, previous findings, risk assessments, and emerging threats into audit planning.

Module 4: Vendor Due Diligence and Onboarding Assurance

• Auditing vendor onboarding procedures, business justification, ownership verification, licensing, financial capacity, capability, and eligibility requirements.

• Evaluating sanctions screening, regulatory checks, conflicts of interest, beneficial ownership, litigation, reputation, and adverse-information reviews.

• Assessing financial viability, operational capacity, insurance, business continuity capability, technology maturity, and service delivery resources.

• Testing whether vendor risk assessments are complete, appropriately documented, approved, risk-rated, and periodically refreshed.

Module 5: Vendor Master Data, Identity and Fraud Controls

• Auditing vendor master files for duplicate entities, inactive vendors, unusual addresses, shared bank accounts, common contacts, and unauthorised changes.

• Assessing vendor identity verification, beneficial ownership, tax information, payment details, licensing, and supporting documentation.

• Identifying fictitious vendors, shell entities, employee-linked suppliers, conflicts of interest, related parties, and suspicious vendor relationships.

• Evaluating controls over vendor creation, modification, approval, access, segregation of duties, periodic cleansing, and independent master-data review.

Module 6: Third-Party Contracts and Service-Level Agreements

• Auditing contracts for scope, deliverables, pricing, service levels, performance indicators, warranties, liabilities, insurance, and termination provisions.

• Assessing data protection, cybersecurity, audit rights, regulatory compliance, confidentiality, business continuity, subcontracting, and incident-reporting clauses.

• Evaluating contract approval, amendments, renewals, extensions, pricing changes, change controls, and documentation of negotiated terms.

• Identifying contractual gaps that may expose the organisation to financial, operational, regulatory, legal, technology, or continuity risks.

Module 7: Vendor Performance and Service Delivery Auditing

• Auditing vendor performance against contractual deliverables, service-level agreements, key performance indicators, quality standards, and agreed timelines.

• Evaluating performance reports, service reviews, complaints, incidents, customer feedback, acceptance documentation, and management oversight.

• Assessing underperformance, service interruptions, recurring deficiencies, missed milestones, contractual penalties, and corrective-action requirements.

• Determining whether vendor performance information is accurate, independently validated, appropriately escalated, and incorporated into risk reassessment.

Module 8: Vendor Financial and Payment Risk Auditing

• Auditing vendor invoices, purchase orders, contracts, goods receipts, service confirmations, payment approvals, and supporting documentation.

• Applying transaction matching and analytical procedures to identify duplicate invoices, overbilling, unsupported charges, incorrect prices, and unauthorised payments.

• Evaluating vendor pricing, rate changes, cost escalation, discounts, rebates, credits, advances, retention amounts, and other commercial arrangements.

• Assessing vendor financial stability, liquidity, dependency, payment exposure, and financial distress indicators that may affect service continuity.

Module 9: Vendor Fraud, Corruption and Misconduct Risks

• Common third-party fraud schemes involving bribery, kickbacks, collusion, false invoices, overbilling, fictitious services, and procurement manipulation.

• Identifying conflicts of interest, related-party relationships, employee-vendor connections, management override, undisclosed commissions, and improper influence.

• Analysing suspicious vendor behaviour through transaction patterns, supplier relationships, unusual pricing, payment anomalies, and procurement activity.

• Developing procedures for investigating suspected vendor fraud, preserving evidence, conducting interviews, documenting findings, and escalating significant concerns.

Module 10: Cybersecurity and Information Security Third-Party Auditing

• Assessing vendor information-security governance, security policies, access controls, authentication, encryption, vulnerability management, and incident response.

• Auditing cloud providers, managed service providers, software vendors, hosting providers, and technology partners with access to organisational systems.

• Evaluating security assessments, independent assurance reports, penetration testing, vulnerability management, security incidents, and remediation activities.

• Assessing risks from privileged access, remote connectivity, system integration, software dependencies, API connections, and third-party cyber incidents.

Module 11: Data Privacy, Confidentiality and Regulatory Compliance

• Auditing third-party handling, processing, storage, transfer, retention, and disposal of personal, confidential, financial, and sensitive organisational information.

• Evaluating privacy obligations, data-processing agreements, confidentiality requirements, consent arrangements, data-location considerations, and breach notification procedures.

• Assessing vendor compliance with applicable laws, regulations, contractual obligations, industry requirements, and organisational policies.

• Identifying risks involving unauthorised data sharing, excessive access, insecure storage, cross-border transfers, inadequate retention, and privacy control deficiencies.

Module 12: Subcontractors, Fourth Parties and Extended Supply-Chain Risk

• Identifying and assessing subcontractors, agents, intermediaries, cloud dependencies, technology providers, and other fourth-party relationships.

• Evaluating whether primary vendors appropriately disclose, assess, monitor, and control subcontractors performing critical or sensitive services.

• Assessing concentration risks, shared infrastructure, common technology providers, geographic dependencies, and interconnected third-party relationships.

• Developing extended supply-chain assurance approaches that provide visibility beyond direct contractual relationships and address cascading risk.

Module 13: Third-Party Resilience, Business Continuity and Exit Planning

• Auditing vendor business continuity plans, disaster recovery capabilities, resilience arrangements, recovery objectives, testing, and crisis-management procedures.

• Assessing critical supplier dependencies, alternative providers, contingency arrangements, substitute resources, inventory buffers, and service recovery capabilities.

• Evaluating exit strategies, transition plans, data return, data destruction, knowledge transfer, contractual termination rights, and replacement-provider readiness.

• Conducting scenario-based assessments of vendor failure, cyber incidents, financial distress, geopolitical disruption, and major service interruptions.

Module 14: Vendor Data Analytics and Continuous Monitoring

• Applying vendor analytics to expenditure, contracts, payments, performance, incidents, risk ratings, and supplier relationships to identify anomalies.

• Using duplicate testing, spend concentration analysis, price variance analysis, transaction trends, risk scoring, and exception reporting.

• Developing dashboards and automated indicators for vendor performance, compliance, cybersecurity incidents, financial deterioration, and control exceptions.

• Integrating continuous monitoring with periodic audits, vendor reassessments, risk acceptance, remediation tracking, and management reporting.

Module 15: Third-Party Audit Evidence, Findings and Remediation

• Determining appropriate evidence for vendor audits and evaluating relevance, reliability, sufficiency, completeness, authenticity, and traceability.

• Preparing working papers covering due diligence, contracts, performance, payments, cybersecurity, privacy, supplier relationships, and control testing.

• Developing findings that clearly connect conditions, criteria, causes, effects, financial exposure, operational consequences, and third-party risks.

• Monitoring remediation, corrective actions, contract improvements, vendor recovery, risk acceptance, control enhancements, and management commitments.

Module 16: Emerging Third-Party Risks and Advanced Assurance Strategy

• Emerging third-party risks involving artificial intelligence providers, cloud concentration, digital ecosystems, platform dependency, geopolitical exposure, and technology outsourcing.

• Assessing AI-enabled vendor services, algorithmic dependencies, model risks, data governance, intellectual property, transparency, and emerging assurance requirements.

• Developing integrated third-party assurance across procurement, risk, compliance, cybersecurity, privacy, finance, legal, business functions, and internal audit.

• Building future-ready vendor risk programmes through continuous assurance, predictive analytics, automated monitoring, supplier intelligence, resilience testing, and risk-based oversight.

Training Approach

This course will be delivered by our skilled trainers who have vast knowledge and experience as expert professionals in the fields. The course is taught in English and through a mix of theory, practical activities, group discussion and case studies. Course manuals and additional training materials will be provided to the participants upon completion of the training.

Tailor-Made Course

This course can also be tailor-made to meet organization requirement. For further inquiries, please contact us on: Email: training@upskilldevelopment.com Tel: +254 721 331 808

Training Venue 

The training will be held at our Upskill Training Centre. We also offer training for a group (at a discount of 10% to 50%) at requested location all over the world. The Onsite course fee covers the course tuition, training materials, two break refreshments, buffet lunch, airport transfers, Upskill gift package, and guided tour.

Visa application, travel expenses, dinners, accommodation, insurance, and other personal expenses are catered by the participant

Certification

Participants will be issued with Upskill certificate upon completion of this course.

Airport Pickup and Accommodation

Airport pickup and accommodation is arranged upon request. For booking contact our Training Coordinator through Email: training@upskilldevelopment.com, +254 721 331 808

Terms of Payment:

Unless otherwise agreed between the two parties’ payment of the course fee should be done 3 working days before commencement of the training so as to enable us to prepare better.