The pattern is consistent enough to be a rule: when a significant data breach occurs at an Australian organisation, look for the third party. A software vendor with excessive access to production systems. A managed service provider whose own security controls were inadequate. A supplier whose credentials were compromised and used to enter the customer’s environment.
Third party risk is the most undermanaged dimension of information security in most organisations. The reason is structural. The tools and processes for managing internal security risk are well-developed, while the visibility into the security posture of external parties is limited, inconsistent, and heavily dependent on the quality of the vendor’s own attestations.

The Questionnaire Problem
The standard approach to vendor security assessment is a questionnaire. The vendor receives a security questionnaire, completes it, returns it, and the customer files it as evidence of due diligence. The questionnaire’s value is entirely dependent on the accuracy and honesty of the responses and on the customer’s capacity to assess those responses critically.
An independent supplier security audit (a 2nd party audit conducted by a qualified auditor) examining actual controls rather than self-reported ones, provides a materially different level of assurance.

Risk-Based Prioritisation
Not every vendor warrants an independent audit. Prioritising audit effort toward vendors with access to sensitive data, vendors with system-level access to your environment, and sole-source technology vendors whose failure would have significant operational impact focuses resources where the risk is highest.
AuditCo provides supplier and third-party security audit services for Australian organisations. Our auditors assess actual controls, not questionnaire responses. Talk to us about your vendor security risk program.

Learn more about AuditCo’s supplier audit services