Third-Party and Vendor Risk Auditing
The contract is the control boundary
Vendors extend the organization's processing footprint and its obligations. Candidates should understand the vendor lifecycle: risk-tiering at onboarding, due diligence proportionate to tier, contractual terms, ongoing monitoring, and offboarding with data return or deletion. The auditor tests whether the vendor inventory is complete, whether tiering is defensible, and whether the contract contains the required privacy and security terms.
Key contract elements include processing purpose and duration, sub-processor approval and flow-down obligations, security commitments, breach notification timelines, assistance with data subject requests and impact assessments, audit or information rights, data location, and deletion or return on termination. The trap is the vendor that was onboarded by a business unit without procurement involvement, so no contract terms exist at all. Another is the sub-processor chain: the primary vendor is compliant, but an undisclosed fourth party holds the data.
Monitoring should be continuous and risk-based. Annual questionnaires are weak on their own; stronger evidence includes independent attestations, shared assessment results, security rating services, and periodic review meetings. Where a vendor cannot provide assurance, the auditor should see a documented risk acceptance with an owner and expiry.
Worked example. A vendor inventory lists 120 suppliers. Comparing it to accounts payable shows 18 additional suppliers receiving personal data. The finding is inventory completeness, with a recommendation to tie vendor onboarding to procurement approval.
Rule of thumb: reconcile the vendor inventory against at least one independent source, then test the top tier in depth and the long tail by attribute.