The Institute of Internal Auditors (IIA) has opened a public comment period to obtain feedback on the draft Third-Party Topical Requirement. Topical Requirements are a new component of the International Professional Practices Framework® (IPPF®).  The IPPF also includes the Global Internal Audit Standards™ and Global Guidance. 

Internal auditors must apply Topical Requirements for assurance engagements when the topic is identified in the risk assessment. They provide mandatory requirements that serve as a baseline for assessing governance, risk management, and control processes related to the topic. 

The Topical Requirement is applicable when the topic is one of the following: 

• The subject of an engagement in the internal audit plan. 
• Identified while performing an engagement. 
• The subject of an engagement request not on the original internal audit plan. 

Conformance with Topical Requirements is mandatory for assurance services and recommended for advisory services. For your reference, a user guide providing further details on the topic, applicability, and supporting guidance in the form of considerations will be published alongside the final version. 

The draft Topical Requirement on the topic of third-party risk is ready for public review. 

First, please read the draft of the Third-Party Topical Requirement at https://www.theiia.org/en/standards/2024-standards/topical-requirements/public-comment-period.  

Next, use this online form to provide comments. 

The form will take about 10 minutes to complete. At the end of the form, you will have the opportunity to input comments.

If you have any questions, please contact Standards-Guidance@theiia.org. Thank you!