Supply Chain Risk Management and Auditing
Learn how to audit supply chain risk management practices. Understand third-party risks and controls for the CISA exam.
Supply Chain Risk in IT
IT supply chain risk encompasses the potential for disruption, compromise, or failure introduced through the products, services, and components that organizations obtain from external sources. For CISA candidates, understanding supply chain risk management is critical because organizations increasingly depend on complex supply chains that introduce risks beyond their direct control.
Types of Supply Chain Risks
IT supply chain risks fall into several categories:
- Security risks: Compromised hardware or software components, malicious code inserted during development or distribution, and unauthorized access through vendor connections.
- Operational risks: Vendor service disruptions, quality issues with supplied components, and single-source dependency that creates vulnerability to vendor failure.
- Compliance risks: Vendors that do not meet regulatory requirements, handle data improperly, or operate in jurisdictions with conflicting legal requirements.
- Integrity risks: Counterfeit components, tampered products, or unauthorized modifications during manufacturing or distribution.
- Availability risks: Supply disruptions due to natural disasters, geopolitical events, or vendor financial instability.
Supply Chain Risk Management Framework
Effective supply chain risk management includes:
- Vendor risk assessment: Evaluating each vendor's security posture, financial stability, compliance capabilities, and operational resilience before engagement and on an ongoing basis.
- Due diligence: Conducting thorough investigation of potential vendors, including security assessments, reference checks, financial analysis, and compliance verification.
- Contractual protections: Including security requirements, right-to-audit clauses, incident notification obligations, and data handling provisions in vendor contracts.
- Continuous monitoring: Ongoing assessment of vendor performance, security posture, and risk profile throughout the relationship.
- Concentration risk management: Identifying and mitigating risks from over-reliance on single vendors or geographic regions.
- Fourth-party risk management: Understanding and managing risks from the vendors that your vendors use (subcontractors and their suppliers).
Software Supply Chain Security
Software supply chain security has received increased attention following high-profile attacks. Key practices include maintaining a software bill of materials (SBOM), verifying the integrity of software updates and patches, scanning open source components for vulnerabilities, implementing secure development practices for internally developed software, and validating vendor development security practices.
Auditing Supply Chain Risk Management
IS auditors should evaluate supply chain risk management by reviewing the vendor risk assessment process for thoroughness and consistency, verifying that contractual protections are adequate, assessing ongoing vendor monitoring activities, evaluating incident response plans that address supply chain disruptions, confirming that concentration risks are identified and mitigated, and reviewing how the organization manages fourth-party risks.
CISA Exam Focus
For the CISA exam, understand the types of supply chain risks, the components of an effective risk management program, and how auditors evaluate supply chain controls. Questions may present vendor management scenarios and ask about appropriate risk management practices or audit recommendations.