Our summary
The Third-Party Topical Requirement is a mandatory part of The IIA’s IPPF. It was issued on 15 September 2025 and became effective on 15 September 2026. It gives auditors a consistent baseline for assessing how an organization governs, manages and controls the risks of working with outside parties. The User Guide describes third parties as external people or entities that supply products or services, such as vendors, suppliers, contractors and outsourced service providers, and it also covers “fourth parties” further down the chain. Employees, regulators and intragroup providers are outside its scope.
The requirement looks at three areas: governance (strategy, policies, roles), risk management (identifying, ranking and monitoring third-party risks and escalating incidents) and controls. The User Guide follows the full third-party lifecycle: selecting, contracting, onboarding, monitoring and offboarding. The page offers the requirement in 24 languages, a User Guide, a report on how it was developed and the general Topical Requirements Application Guidance. It is for internal audit teams, chief audit executives and anyone who owns vendor or outsourcing risk.
How auditors use it: Use it as a checklist when you plan any audit that touches suppliers or outsourcing. Test areas such as due diligence, contract terms (for example service levels and right-to-audit clauses), ongoing monitoring and exit plans, and document why any part of the requirement does not apply.