Service provider audits by specialists
Audits are becoming a key priority – and we help you put them into practice!
Your path to a service provider audit
Requirements
1
The word “audit” appears 20 times in the nine-page RTS (2024/1773). Audits have always been within the scope of the German Banking Act (KWG) and MaRisk. Yet they have never been as prominent as they are today.
As DORA requirements continue to be implemented, the focus is gradually shifting towards operational effectiveness. In the process, unexpected gaps in service provider auditing are becoming increasingly apparent.
If you still have some catching up to do, the following information may be useful. If you continue to view this topic as solely the responsibility of your third line of defence, it may be time to take a closer look at DORA.
Conceptual framework
2
How do you build an audit framework like this? Start by bringing together all relevant stakeholders, particularly all second-line functions, to agree on a common approach. You will often find that service provider audits are already being conducted elsewhere in your organisation, but only within a limited scope. Your information security colleagues will probably tell you that they, too, are already conducting audits or planning to do so. You may also be aware that your third line of defence already audits service providers. So invite a third-line representative to the discussion as well.
The key questions to address in this initial discussion are:
Who is responsible for planning service provider audits? Just because the third line maintains an audit plan covering its audit universe does not mean it also plans and tracks the audits that primarily fall within your second-line remit.
What types of audits should we use? An on-site visit is often the first thing that comes to mind. But sending five people to inspect boxes in storage together is rarely the best approach. Many matters can be addressed through a self-assessment, for example.
How often should audits take place? You need predefined frequencies, alongside the flexibility to adjust them based on findings from ongoing management and monitoring.
What should the audit cover? This is the most demanding part. If you start auditing every service provider indiscriminately against a broad scope, the audits will never end. The quality of your findings will decline, and follow-up on actions will suffer. Our recommendation is to define the audit scope on a risk basis, drawing on your risk analysis and insights from ongoing management and monitoring. The good news is that you are very likely to have already gathered all the information needed to develop such a risk-based audit plan.
How will you document your audit? A clear written record matters and service provider audits are no exception. Define which documents you will use as evidence of your audit work and the format in which they should be maintained.
3
Conducting your service provider audit
You have developed your audit framework, raised awareness across your organisation and are ready to get started? Now comes the easiest part: who will do the work?
As you have probably grown accustomed to over the years, capacity is often stretched in both your second-line functions and your first line. This leaves you with three options:
You deprioritise other tasks: Usually not the best idea.
You recruit additional staff: Usually not something you can do at short notice.
You outsource your audit activities: Our favourite option, naturally. You could, for example, outsource them to us.
Continual improvement
4
The most important step was getting started. Your initial findings will have given you valuable experience. Along the way, you may discover that you carried out unnecessary checks, overlooked certain areas or did not define corrective actions properly. That is part of the learning process. Update your framework at least annually as part of a continual improvement process.
After a few years, you will have a much clearer understanding of how your service provider actually operates. You will be able to identify risks and take mitigating action much more quickly. Because one thing will not change: certificates, reports and statements are, initially, just words on paper. Only an audit reveals how things work in practice.
Identify risks early
Service provider audits
We can support you in three areas.
1 - Developing your service provider audit framework
Developing a coordinated service provider audit plan takes time and dedicated effort. We first identify how to build a risk-based audit plan for your organisation, then bring all relevant stakeholders together. We support you through to your first audit, including preparing all the necessary documentation.
2 - Auditing your service provider’s third-party risk management
Your service provider’s outsourcing management also needs to be audited periodically. We support you by reviewing and assessing all relevant outsourcing management documentation and recommending risk mitigation measures where necessary. Our assessment draws on the service provider’s documented policies and procedures, your contract with them and a live interview. This includes sample-based checks of how the service provider manages and monitors its own service providers.
3 - Comprehensive service provider audit
We can support you in planning, coordinating and conducting your audit. We carry out the audit work ourselves in our core area of expertise: third-party risk management and outsourcing management. For other disciplines, such as information security and business continuity management (BCM), we work with boutique consultancies specialising in their respective fields.