Supplier and service provider management audit program.
How to audit whether service providers and suppliers are selected by risk, bound by contract, monitored on an ongoing basis and properly offboarded when the relationship ends.
Last updated: 13 October 2026 · Sample, not legal advice
Download the sample as PDF 8 pages, no sign-up
Download as Excel template with columns for result and notes, no sign-up
Audit objective
The audit assesses whether the organisation governs information security in its relationships with service providers and suppliers: from recording and classification through selection and contractual safeguards to monitoring performance, handling changes and termination. It also assesses whether supply chains and subcontractors are taken into account.
Scope
- Service providers and suppliers with access to the organisation’s information, systems or premises, and IT suppliers of essential services
- Processes for selection, engagement, monitoring, change and termination
- Responsible functions in procurement, business units, information security and legal
- Out of scope: rules specific to financial entities under DORA and cloud use, which are covered in separate samples
Audit program
| No. | Criterion | Reference | Audit procedure | Expected evidence |
|---|---|---|---|---|
| 1 | A policy on information security in supplier relationships exists, is approved and sets requirements according to the classification of the provider. | ISO/IEC 27001:2022 Annex A 5.19; NIS2 Directive Art. 21(2)(d) | Read the policy and check whether classification, roles and minimum requirements are defined. | Policy with approval record, classification scheme |
| 2 | A complete inventory of service providers and suppliers with classification, contact person and contract data is maintained. | ISO/IEC 27001:2022 Annex A 5.19; § 30(2) no. 4 BSIG | Compare the inventory with the accounts payable list and access rights of externals to find providers that are not recorded. | Provider inventory, accounts payable extract, list of external users |
| 3 | Before engagement, risks are assessed and providers are checked for suitability, including in terms of information security. | ISO/IEC 27001:2022 Annex A 5.19; NIS2 Directive Art. 21(3) | For five new providers of the last twelve months, review the assessment made before the contract was signed. | Risk assessments, questionnaires, certificates, decision notes |
| 4 | Contracts contain security requirements, rules on the handling of information, incident reporting duties, audit rights and consequences of breaches. | ISO/IEC 27001:2022 Annex A 5.20 | Review the contracts in the sample against a checklist and record missing provisions. | Contracts and annexes, completed checklist |
| 5 | The supply chain is considered: subcontractors are known, approved and subject to equivalent requirements. | ISO/IEC 27001:2022 Annex A 5.21; NIS2 Directive Art. 21(2)(d) | For three essential providers, ask about subcontractors and check approval and the passing on of requirements. | Lists of subcontractors, approvals, contract clauses |
| 6 | Access by service providers is limited to what is necessary, approved individually, time-limited and logged. | ISO/IEC 27001:2022 Annex A 5.19 and 5.15 | Read external accounts and check approval, time limit and use in recent months for a sample. | Extract of external accounts, approvals, logs |
| 7 | Performance and security of providers are monitored regularly, for example through reports, certificates and audits on site or remotely. | ISO/IEC 27001:2022 Annex A 5.22 | Review the monitoring plan and the reports of the last twelve months for essential providers. | Monitoring plan, performance reports, audit reports, certificates |
| 8 | Findings from monitoring are tracked and clarified with the provider until resolved. | ISO/IEC 27001:2022 Annex A 5.22 | Review open and closed findings of the last twelve months and check deadlines and closure. | Action list, correspondence, meeting minutes |
| 9 | Changes to services and contracts are assessed before they take effect, including in terms of information security. | ISO/IEC 27001:2022 Annex A 5.22 | Review contract amendments and announced provider changes in the sample for an assessment. | Change notices, assessment notes |
| 10 | Security incidents at providers are reported, recorded and taken into the organisation’s own incident management. | ISO/IEC 27001:2022 Annex A 5.20; BSI DER.2.1 | Check whether provider incidents appear in the incident register and whether reporting paths are agreed. | Incident register, contact list, reporting paths in the contract |
| 11 | When a relationship ends, access is withdrawn, information is returned or deleted and deletion is confirmed. | ISO/IEC 27001:2022 Annex A 5.19 and 5.18 | Select two terminated provider relationships and check withdrawal of access and return or deletion of data. | Termination record, deletion confirmation, extract of access |
| 12 | Management is informed about supply chain risks and about significant findings. | NIS2 Directive Art. 20 | Review reports and minutes of the last twelve months for topics on supplier management. | Reports to executive management, meeting minutes |
Documents to request
- Policy on information security in supplier relationships
- Provider inventory with classification
- Risk assessments and selection documents of the sample
- Contracts with annexes on security and data processing
- Lists of subcontractors
- Monitoring plan, performance reports and audit reports
- Extract of external accounts and access by service providers
- Termination records and deletion confirmations
Typical findings
- The provider inventory is incomplete; some providers with system access are missing.
- Selection is made on price and expertise, with no assessment of information security.
- Contracts contain no reporting duty for security incidents and no audit rights.
- Subcontractors are not known or not approved.
- Monitoring is limited to receiving reports, and findings are not followed up.
- Provider access remains in place after the end of the contract.
Note on references
The references point to laws, regulations and standards so that you can read the requirement in the original. No normative text is reproduced. Criteria and procedures are original wording and replace neither the text of the provisions nor legal advice. Whether and to what extent a provision applies to your organisation should be clarified before the audit.
The complete package
This sample shows the objective, the audit steps and the document list on one page. For your own audit topic, ProAuditMap creates the complete package: audit plan, audit program per audit dimension, document request list, interview guides, schedule, communication and report template. You review the draft, approve it and export to Excel and Word.
Create account View a complete sample package View pricing