ISA 4.0 Module 3 – Topic Wise

Module 3: Third-Party and Outsourcing Audits (TPRM) Vendor Lifecycle Governance, Cloud & SaaS Assurance, SOC Reports & Privacy Compliance Course Overview & Scope: As organizations increasingly outsource core banking, IT infrastructure, cloud hosting, and software development, Third-Party Risk Management (TPRM) has emerged as one of the highest-priority audit areas. This course walks candidates through the entire vendor lifecycle: Pre-Contract Due Diligence, Sourcing & Selection, Contractual Safeguards (Right to Audit, SLAs, Incident Notification), Ongoing Performance Monitoring, Fourth-Party (Supply Chain) Risk, and Exit/Offboarding. Special emphasis is given to interpreting SOC 1 / SOC 2 reports, evaluating cloud shared responsibility, and auditing compliance with the Digital Personal Data Protection (DPDP) Act 2023 and cross-border transfer rules. Key Regulatory Frameworks & Standards Covered: ISO/IEC 27036 (Supplier Relationships), NIST SP 800-161 (Cybersecurity Supply Chain), AICPA SOC 1/2/3, RBI Master Direction on Outsourcing of IT Services (2023). Core Audit Competencies Tested in Quizzes:

• Auditing vendor onboarding due diligence, financial health checks, and security capability assessments.
• Evaluating outsourcing agreements for essential clauses: SLA, Right to Audit, Sub-contractor approval, and Escrow.
• Reading and critically analyzing SOC 1 (Type II) and SOC 2 (Type II) reports, Complementary User Entity Controls (CUECs).
• Assessing Fourth-Party concentration risk and supply chain dependencies in mission-critical applications.
• Reviewing cross-border data transfer mechanisms and compliance with the Indian DPDP Act 2023.

Detailed Topic-Wise Active Quiz Index (Module 3)

Chapter / Section	Topic Quiz Title	Qs
Chapter 1: TPRM Fundamentals & Outsourcing Models	Outsourcing	11
	Concepts of IS Audit – Definitions	2
	Risk Response-5	32
Chapter 2: Audit Scope & Vendor Lifecycle Coverage	Setting up of Audit objectives	6
	Audit scope	11
	Business application software – parameters for selection	5
	Role of IS Auditors	1
Chapter 3: Framework References & Assurance Artifacts	COBIT 2019 Governance System Principles	3
	Components of the Governance System as per COBIT 2019	3
Chapter 4: Privacy Considerations & DPDP Compliance	Risk Response-5	32
	Application Controls Review	7
Chapter 5: Practical Tools, RACI & Audit Checklists	Outsourcing	11
	Threat Modelling Tools	9
	Periodic Review and Monitoring of Risk and Controls	8
Chapter 6: Common Red Flags & Practical Audit Tips	Outsourcing	11
	Phase 1: Establish the Desire to Change	1
	Processes	5
Chapter 7: Case Study Exercises	Outsourcing	11
	Risk Identification	1
	Control practices	8
	Risk Response-5	32
Chapter 8: Annexures & Reference Materials	Role of IS Auditors	1
	Control Assessment	20
	TOTAL ACTIVE QUESTIONS IN MODULE 3:	231