Third-Party Risk & Assurance

Organizations increasingly depend on suppliers, contractors, outsourced service providers, technology vendors, consultants, and strategic partners to deliver critical activities. These relationships can extend organizational capability, but they also create exposures that may not be directly controlled by the organization. A third party experiencing operational disruption, financial weakness, security failure, regulatory issues, or dependence on its own subcontractors can quickly affect service continuity, reputation, and business performance.
 

Boost Consulting & Training offers this course to develop a lifecycle approach to third-party risk and assurance. Participants learn to determine third-party criticality, assess exposure before engagement, conduct proportionate due diligence, establish risk requirements, monitor changing conditions, evaluate assurance evidence, respond to incidents and deterioration, and manage risk during renewal, transition, or exit. The emphasis is on directing assurance effort toward relationships capable of creating the greatest organizational impact.
 

The main concept of this course is to maintain visibility and assurance over third-party exposure throughout the relationship lifecycle rather than treating risk assessment as a one-time activity before engagement.

• Identify different forms of organizational dependency on third parties.
• Classify third parties according to criticality and potential organizational impact.
• Conduct proportionate risk assessment and due diligence before engagement.
• Establish appropriate risk requirements and assurance expectations.
• Evaluate evidence provided by third parties rather than relying solely on declarations.
• Monitor indicators of changing third-party exposure throughout the relationship.
• Respond effectively to incidents, deterioration, and significant changes involving third parties.
• Manage risk during renewal, transition, termination, and exit.