OverviewFile ReviewsHorizontalThematicIssue ValidationAudit Plan QAAudit Committee QAEQARequirementsQA FindingsReportsSettings
Quality Assurance
Thematic Reviews
The Thematic Review Agent searched the audit universe, risk assessment, plan, scopes, programs, workpapers, issues, reports and Audit Committee materials.
Coverage matrix — Third-party risk
5 sub-themes · 3 relevant audits
| Risk / sub-theme | Procurement & P2P | Third-Party Risk Management | Identity & Access Management | Coverage |
|---|---|---|---|---|
| Vendor onboarding due diligence | Covered | Covered | — | Covered |
| Critical supplier concentration | — | Partially | — | Potential gap |
| Vendor cyber posture | — | Partially | Covered | Partially |
| Contract compliance / rebates | — | — | — | Potential gap |
| Offboarding & access revocation | — | Covered | Covered | Covered |
Potential gaps
A lack of evidence is not automatically a deficiency
Potential gap · Critical supplier concentration
Rated High in the FY26 ERM register (R-14) but only discussed in a planning memo for IA-2617; no procedures executed. Potentially insufficient coverage — requires reviewer assessment.
Potential gap · Contract compliance / rebates
No audit program steps located across the portfolio. May be covered by Finance's rebate review — requires reviewer assessment before any finding.