Supplier Monitoring

Gain Visibility Into Critical Suppliers to Assess
Risk with Confidence

Supplier relationships evolve over time. New risks emerge, evidence becomes outdated, and regulatory requirements continue to change. This makes it all the more important to assess critical suppliers regularly and provide internal and external evidence that agreed security and compliance requirements continue to be met.

Continuous supplier monitoring provides the necessary foundation. It is a key component of effective Third-Party Risk Management (TPRM) and helps organizations continuously assess and appropriately manage risks in supplier relationships. At the same time, you can meet requirements arising from laws, regulations, standards, and industry frameworks, including:

 

  • Legal and regulatory requirements such as DORA, MaRisk, NIS-2, and KRITIS
  • Requirements from standards such as ISO 9001 and ISO 27001
  • Internal requirements
  • Industry requirements such as TISAX or AirCyber

      In practice, not every supplier is equally important to an organization. Accordingly, monitoring measures should also be risk-based. Assessing all suppliers according to the same approach often primarily creates additional effort. It makes more sense to align the level of effort and depth of review with the importance of the respective supplier.

      Jan Kemper, Principal usd Security Audits

      Why Choose usd AG for Supplier Monitoring?

      Whether you need to conduct a single supplier audit or monitor a large number of different suppliers throughout the year, our auditors support you in planning, conducting, and following up on your supplier audits. You benefit from hands-on experience across a wide range of industries and audit environments.

      You benefit from the expertise, experience,
      and objectivity of our qualified audit experts.

      You gain transparency into security and
      compliance requirements, even across
      complex supplier environments.

      You focus your resources where they matter
      most through risk-based monitoring measures.

      You can provide customers, auditors,
      and regulators with clear, traceable evidence
      that security and compliance requirements
      are being met.

      You benefit from the expertise, experience, and objectivity of our qualified audit experts.
      You gain transparency into security and compliance requirements, even across complex supplier environments.
      You focus your resources where they matter most through risk-based monitoring measures.
      You can provide customers, auditors, and regulators with clear, traceable evidence that security and compliance requirements are being met.

      What Can You Expect from Supplier Monitoring by usd AG?

      Together with you, we determine which suppliers to include in the monitoring program and which areas to focus on. Depending on your risk exposure and objectives, we apply different measures. Where risks are higher or additional information is needed, additional supplier audits may be appropriate. This gives you reliable results as a basis for informed decisions and traceable assessments of your suppliers.
      Our Approach to Supplier Monitoring:

      The scope and depth of supplier monitoring depend on criticality, risk exposure, and regulatory requirements. The key is to determine which evidence is sufficient and when additional audit procedures are necessary. Not every supplier requires the same level of monitoring. What matters are the risks associated with the service and the supplier’s importance to your business processes, systems, or information.

      Typical Measures for Supplier Monitoring:
       

      • Reviewing self-assessments and questionnaires
      • Evaluating third-party certificates and attestations, such as ISO 27001 certificates,
        or ISAE 3402 reports, and BSI C5 attestations
      • Analyzing the records and documentation provided
      • Conducting supplier audits in cases of elevated risk.
      Supplier Audits as an In-Depth Measure

      A more in-depth review may be required for selected suppliers. The scope, audit focus, and approach depend on the service provided, the associated risks, and the audit objectives. In practice, a structured process consisting of preparation, audit execution, and follow-up has proven effective:
      Ihr Titel
      Your content goes here. Edit or remove this text inline or in the module Content settings. You can also style every aspect of this content in the module Design settings and even apply custom CSS to this text in the module Advanced settings.

      Preparation

      • Aligning on scope and approach
      • Selecting the topics and evidence to be reviewed
      • Announcing the audit and coordinating with internal stakeholders and, subsequently, the supplier

      Audit Execution

      • Reviewing documentation and evidence
      • Interviewing relevant contacts
      • Conducting an on-site or remote audit
      • Assessing security requirements and controls

      Follow-Up

      • Evaluating the results
      • Documenting findings
      • Presenting the results
      • Identifying and tracking measures

      To prevent risks from going undetected, supplier monitoring should be reviewed regularly and adapted to changing circumstances. The appropriate measures and review frequency depend in particular on the supplier’s criticality, the outsourced service, and the current risk exposure.

      Conducting Pooled Audits, for Example Under DORA

      As part of our supplier audit offering, we also conduct pooled audits. In a pooled audit, a supplier is audited in the interest of several organizations. This can offer an efficient, resource-conscious alternative to separate audits. Regulatory requirements such as DORA also provide for pooled audits as a possible form of audit in certain contexts.

      Learn More About Third-Party Risk Management (TPRM)

      Third-Party Risk Management:
      Basics

       

      Third-Party Risk Management: How to Set Up a TPRM Program

       

      Information Security in
      Third-Party Risk Management:
      How to Monitor Your
      TPRM Program

       

      TPRM: EBA Publishes
      Guidelines on Third-Party Risk Management
      for Non-ICT Services

       

      Do you have any questions?

      Feel free to contact us. We are happy to help.
      .


      Benedikt Krümmel
      Head of Sales - Security Audits

       

      📞 +49 6102 8631-190
      📧 sales@usd.de
      Download S/MIME Certificate