{"id":12360,"date":"2017-10-10T08:50:27","date_gmt":"2017-10-10T08:50:27","guid":{"rendered":"https:\/\/multiacademstg.wpengine.com\/27001academy\/?p=12360"},"modified":"2024-12-21T13:18:50","modified_gmt":"2024-12-21T13:18:50","slug":"how-to-perform-an-iso-27001-second-party-audit-of-an-outsourced-supplier","status":"publish","type":"post","link":"https:\/\/advisera.com\/27001academy\/blog\/2017\/10\/10\/how-to-perform-an-iso-27001-second-party-audit-of-an-outsourced-supplier\/","title":{"rendered":"How to perform an ISO 27001 second-party audit of an outsourced supplier"},"content":{"rendered":"<p>To focus on their core business, many organizations rely on outsourced suppliers to perform support processes. While this approach may bring benefits like costs savings, and access to expert knowledge and state-of-the-art technology, it can also involve risks related to loss of control over how these processes are performed and managed.<\/p>\n<p>To minimize such risks, organizations should adopt practices to ensure that the processes and deliverables of outsourced suppliers are exactly what they are paying for.<\/p>\n<p>This article will present some solutions that organizations should consider when performing audits of outsourced suppliers that could impact their information security. These suggestions are based on controls recommended by\u00a0<a href=\"https:\/\/advisera.com\/27001academy\/what-is-iso-27001\/\" target=\"_blank\" rel=\"noopener noreferrer\">ISO 27001<\/a>, the leading international standard for information security management.<\/p>\n<h2>Can organizations audit their suppliers?<\/h2>\n<p>Yes. Basically, there are three types of audits that can be performed, which depend on the relationship between the auditor and the auditee: first-, second-, and third-party audits. For the purpose of this article, only second-party audits will be covered. For information about first- and third-party audits, please see <a href=\"https:\/\/advisera.com\/9001academy\/blog\/2015\/02\/24\/first-second-third-party-audits-differences\/\" target=\"_blank\" rel=\"noopener noreferrer\">First-, Second- &amp; Third-Party Audits, what are the differences?<\/a><\/p>\n<p>Second-party audits involve two independent organizations that have a relationship established between them. The most common scenario is a customer auditing a supplier, but you also can have a regulatory body auditing an organization that operates in an industry it oversees.<\/p>\n<p>As a customer, you can either use your own personnel to perform a second-party audit on your supplier, or you can hire an external auditor\/organization to perform the audit on your behalf.<br \/>\n<div id=\"middle-banner\" class=\"banner-shortcode\"><\/div><script>loadMiddleBanner();<\/script><br \/>\n<div id=\"side-banner-trigger\" class=\"banner-shortcode\"><\/div><\/p>\n<h2>Second-party audit process<\/h2>\n<p>First of all, the right of a customer to audit its supplier has to be clearly established in the service agreement or contract with the supplier. This agreement\/contract is the main document to define:<\/p>\n<ul>\n<li>the authority of the customer\u2019s organization, or of those performing the audit on its behalf, to audit the supplier\u2019s processes<\/li>\n<li>the scope of the audit and the security controls that the supplier will have to implement, including those it will have to enforce on its own suppliers<\/li>\n<\/ul>\n<p>ISO 27001 has specific security controls requiring these issues to be established, and the more specific and clear they are, the easier the audit will become. For more information, see <a href=\"https:\/\/advisera.com\/27001academy\/blog\/2014\/06\/30\/6-step-process-for-handling-supplier-security-according-to-iso-27001\/\" target=\"_blank\" rel=\"noopener noreferrer\">6-step process for handling supplier security according to ISO 27001<\/a> and <a href=\"https:\/\/advisera.com\/27001academy\/blog\/2017\/06\/19\/which-security-clauses-to-use-for-supplier-agreements\/\" target=\"_blank\" rel=\"noopener noreferrer\">Which security clauses to use for supplier agreements?<\/a><\/p>\n<p>The good news is that the main steps for a second-party audit are practically the same as those required for an <a href=\"https:\/\/advisera.com\/27001academy\/documentation\/internal-audit-procedure\/\" target=\"_blank\" rel=\"noopener noreferrer\">internal audit<\/a>:<\/p>\n<ol>\n<li><strong>Defining the <a href=\"https:\/\/advisera.com\/27001academy\/documentation\/annual-internal-audit-program\/\" target=\"_blank\" rel=\"noopener noreferrer\">audit program<\/a><\/strong> \u2013 the establishment of an agreed schedule between customer and supplier of when the audit, or audits, will happen.<\/li>\n<li><strong>Planning individual audits<\/strong> \u2013 the definition of which processes will be audited and how (based on the service agreement\/contract), including the review of previous audits and preparation of <a href=\"https:\/\/advisera.com\/27001academy\/documentation\/internal-audit-checklist\/\" target=\"_blank\" rel=\"noopener noreferrer\">checklists<\/a>.<\/li>\n<li><strong>Conducting the audit<\/strong> \u2013 the auditor goes to where the processes are performed to gather information and evaluate whether the processes are functioning as defined in the service agreement or contract established with the supplier, and whether they are effective in producing the required results.<\/li>\n<li><strong>Reporting the <a href=\"https:\/\/advisera.com\/27001academy\/documentation\/internal-audit-report\/\" target=\"_blank\" rel=\"noopener noreferrer\">audit results<\/a><\/strong> \u2013 the communication to the interested parties (client organization and supplier) about what is working properly, which points out any corrective actions necessary to address non-conformities, as well as any issues to be evaluated as opportunities for improvement.<\/li>\n<li><strong>Follow up on actions taken<\/strong> \u2013 the verification of the effectiveness of the <a href=\"https:\/\/advisera.com\/27001academy\/documentation\/corrective-action-form\/\" target=\"_blank\" rel=\"noopener noreferrer\">treatment of non-conformities<\/a> (if they have, in fact, eliminated the problems found), as well as of any implemented improvements.<\/li>\n<\/ol>\n<p>So, if your organization already has an audit process in place, or if your organization is thinking about implementing an audit process, you can apply this same process to your suppliers.<\/p>\n<h2>Tips on how to audit suppliers<\/h2>\n<p>Considering ISO 27001 controls from section A.15, and the most common security clauses applicable to service agreements\/contracts, on the supplier\u2019s premises, an auditor should look for, at a minimum, evidence regarding:<\/p>\n<ul>\n<li>Controls enforced by the supplier on its own supply chain.<\/li>\n<li>Awareness and training of the supplier\u2019s personnel about information security.<\/li>\n<li>Internal reports of controls\u2019 performance, internal audits, and capacity levels, and their respective reviews, including any required action to be performed, and the results achieved by the actions already implemented.<\/li>\n<li>Reports of security incidents (which should include what has happened, impacts, and actions taken to prevent recurrence).<\/li>\n<li>Records of changes performed, as well as those that are planned, considering changes in agreements\/contracts, supplier\u2019s infrastructure, and provided services.<\/li>\n<\/ul>\n<p>Of course, as mentioned previously, the auditor must have the relevant service agreements\/contracts on hand, so he can identify additional evidences that may be applicable to your specific scenario (e.g., tests of business continuity plans).<\/p>\n<h2>Your providers\u2019 security should be as good as your own<\/h2>\n<p>The motto \u201csecurity is only as strong as its weakest link\u201d applies well to the customer-supplier relationship, making auditing practices essential to ensuring that operations are being performed as agreed and expected results are being achieved.<\/p>\n<p>By considering the controls and recommendations of ISO 27001 regarding information security in suppliers\u2019 relationships, an organization can ensure not only that its suppliers are handling its information properly, but that both customer and supplier have good visibility of all the processes and can act in a timely manner to prevent information compromise.<\/p>\n<p><em>To learn more about auditing techniques, see this free online training<\/em> <a href=\"https:\/\/advisera.com\/training\/iso-27001-internal-auditor-course\/\" target=\"_blank\" rel=\"noopener noreferrer\">ISO 27001 Internal Auditor Course<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>To focus on their core business, many organizations rely on outsourced suppliers to perform support processes. While this approach may bring benefits like costs savings, and access to expert knowledge and state-of-the-art technology, it can also involve risks related to loss of control over how these processes are performed and managed. To minimize such risks, &#8230;<\/p>\n","protected":false},"author":41,"featured_media":81281,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[125,176,381,1655,1656],"class_list":["post-12360","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-internal-audit","tag-compliance","tag-iso-27001","tag-outsourced-services","tag-second-party"],"acf":[],"_links":{"self":[{"href":"https:\/\/advisera.com\/27001academy\/wp-json\/wp\/v2\/posts\/12360","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/advisera.com\/27001academy\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/advisera.com\/27001academy\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/advisera.com\/27001academy\/wp-json\/wp\/v2\/users\/41"}],"replies":[{"embeddable":true,"href":"https:\/\/advisera.com\/27001academy\/wp-json\/wp\/v2\/comments?post=12360"}],"version-history":[{"count":1,"href":"https:\/\/advisera.com\/27001academy\/wp-json\/wp\/v2\/posts\/12360\/revisions"}],"predecessor-version":[{"id":103224,"href":"https:\/\/advisera.com\/27001academy\/wp-json\/wp\/v2\/posts\/12360\/revisions\/103224"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/advisera.com\/27001academy\/wp-json\/wp\/v2\/media\/81281"}],"wp:attachment":[{"href":"https:\/\/advisera.com\/27001academy\/wp-json\/wp\/v2\/media?parent=12360"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/advisera.com\/27001academy\/wp-json\/wp\/v2\/categories?post=12360"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/advisera.com\/27001academy\/wp-json\/wp\/v2\/tags?post=12360"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}