PaySecure India, a prominent online bill payment platform in India, encountered a major security breach in FY 2023-24, compromising the financial details of millions of users. A cybersecurity analyst discovered that the

Third-party risk management is an emerging area of focus in internal audit, and it is gaining more attention due to the increasing reliance on third-party vendors by organizations. Many companies now outsource critical business functions to third-party vendors to reduce costs, increase efficiency, and gain access to specialized expertise. However, this outsourcing exposes organizations to new and evolving risks, such as data breaches, cyber-attacks, financial fraud, regulatory non-compliance, and reputational damage. Internal auditors are responsible for assessing and managing risks within their organizations, and third-party risk management is an area where they can add significant value. Internal audit can help to identify potential risks associated with third-party relationships, evaluate the effectiveness of controls, and make recommendations to management on how to mitigate risks. In the context of third-party risk management, internal auditors can perform the following key activities: Adequate Due Diligence: Companies need to conduct thorough due diligence on third-party vendors before engaging with them. This includes verifying their security controls and practices, and ensuring that they are in compliance with data protection laws and regulations. Clear Contractual Provisions: Contracts between companies and third-party vendors need to include clear provisions that outline specific security requirements and obligations. Including data protection, breach notification, and liability. Ongoing Monitoring: Companies need to establish a process for monitoring third-party vendors regularly to ensure they comply with the contractual provisions, and to detect any potential vulnerabilities or breaches. Effective Incident Response: Companies need to have an effective incident response plan in place to respond to security breaches effectively, including notifying affected customers, regulators, and law enforcement, and taking appropriate action to mitigate the impact of the breach. This case focuses and bring out the importance of implementing effective third-party risk management processes to minimize the risks associated with engaging the third-party vendors. Companies need to conduct thorough due diligence on vendors, ensure that contractual provisions are in place to manage risks, regularly monitor vendors, and have an effective incident response plan in place. By doing so, companies can protect themselves from the reputational and financial damage that can result from a breach of third-party vendors.