Supplier Audit Training

SUPPLIER AUDIT TRAINING — TPRM

More than half of all breaches go through your supplier's door; Control discipline closes this door.

Supplier Audit Training; üçüncü taraf risk ynetimi (TPRM) çerçevesinde tedarikçi seçimi, soru listesi tasarımı, yerinde denetim yntemi, bulgu sınıflandırma ve sürekli izleme süreçlerini ele alır. ISO 27001 Annex A 5.19-5.23, KVKK veri işleyen, BDDK ve EBA dış kaynak ynetimi gereklilikleri bütünleşik olarak işlenir. Eğitim, klasik soru listesi yaklaşımının tesine geçerek modern bir denetim metodolojisi sunar.

Check out the Training Flow Request a Training Plan
Third Party Risk Management ISO 27001 Annex A 5.19-5.23 KVKK Data Processor BRSA Outsourcing Continuous Monitoring
Supplier Risk Maturity Dashboard
AUDIT + MONITORING
Envanter
tam
Classification
kritiklik
Continuous monitoring
otomatik
%62There is a supplier trace in the violation
4. TarafThe supplier's supplier is also a risk
SBOMsoftware component transparency
TPRMThird party risk management; the entire life cycle, from supplier selection to contract completion.
Annex AISO 27001:2022 Annex A Articles 5.19-5.23 regulate supplier relations.
SIG/CAIQIndustry standard supplier evaluation questionnaires.
4. TarafTedarikçinizin tedarikçisi; modern TPRM’in gz ardı edilemez katmanı.
PURPOSE OF EDUCATION

Supplier auditing is not about sending out a list of questions; is to establish a control ecosystem.

In many institutions, supplier auditing is carried out by the supplier filling out and returning an Excel questionnaire sent annually, with an average of 200 items. This approach can meet the documentation obligation; but it cannot measure actual risk. Whether the answers are correct or not cannot be known unless one walks through the supplier's door.

Modern tedarikçi denetimi; risk bazlı yaklaşımla başlar, soru listesini kuruma zel uyarlar, critical supplierlerde yerinde denetim yapar, kanıt toplar, bulguyu sınıflandırır, kapanış izlemesi yürütür ve tedarikçinin durumunu yıl boyu sürekli izler. Bu eğitim; ISO 27001 Annex A 5.19-5.23, KVKK veri işleyen yükümlülükleri, BDDK ve EBA dış kaynak ynetimi düzenlemeleri ile sahada gerçekten işleyen denetim metodolojisini bir araya getirir.

Amaç: Katılımcıların tedarikçi inventoryni doğru şekilde sınıflandırması, denetim soru listelerini risk bazlı tasarlaması, yerinde denetim yapabilmesi, kanıt toplama disiplinini ğrenmesi, bulgu raporlaması ve sürekli izleme yntemleri kurmasıdır.
A significant portion of the violations come from suppliers.Supplier-centered attacks such as Solar Winds, Kaseya, Okta, MOVEit have shown that even institutions with the strongest security controls can be breached through a weak supplier. Supplier auditing is no longer an optional process.
Sending a list of questions alone is not an audit.The Excel form filled out by the supplier meets the documentation obligation but does not prove the existence of an actual control. This training shows the difference between a list of questions and an actual audit.
Legislation sees auditing as a continuous process, not a one-time process.ISO 27001:2022 Annex A 5.22, KVKK data processor obligations, BRSA Information Systems Regulation and EBA outsourcing guide; Requires supplier monitoring to be carried out throughout the life cycle. A single annual question list does not meet this obligation.
Your supplier's supplier is also your risk.Modern tedarik zincirinde 4. taraf riski (tedarikçinizin tedarikçisi) gerçek bir tehdit halindedir. Yazılım bileşen listesi (SBOM), bulut zincir grünürlüğü ve alt yüklenici inventory gibi konuları ğrenmek artık zorunlu.
CLASSICAL APPROACH AND MODERN APPROACH

This training adds a modern TPRM methodology on top of the classic question list audit.

Pek çok tedarikçi denetim eğitimi 2010’ların yaklaşımı üzerine kuruludur: bir tedarikçi soru listesi gnderilir, geri dnen formlar arşivlenir. Bu yaklaşım dokümante eder ama korumaz. Modern TPRM ise bütüncül bir kontrol ekosistemi kurar.

Klasik Supplier Denetim Yaklaşımı Question list-oriented, documentation-oriented

  • The same Excel form with 200 items is sent to each supplier.
  • One-time annual review
  • Supplier response is accepted, no evidence is required
  • Critical and low-risk suppliers receive the same treatment
  • On-site inspections are not carried out or are carried out infrequently
  • Findings tracking not tracked
  • 4th party risk is ignored
  • Result: documented risk, unprotected institution

Modern TPRM Methodology Risk-based, evidence-driven, continuous monitoring

  • Different question sets based on supplier classification
  • Continuous monitoring throughout the lifecycle
  • On-site audit and evidence collection at critical supplier
  • Standard references such as SIG, CAIQ, ISO 27001, SOC 2
  • Contractual audit right and time obligations
  • Finding closure follow-up and escalation
  • 4th party visibility and SBOM discipline
  • Result: measurable control, auditable process
EDUCATIONAL ACHIEVEMENTS

Participants learn to evaluate supplier auditing together on the axis of risk management, legislation and evidence discipline.

The training does not teach a single auditing tool or platform. It conveys the risk-based audit methodology and which approach will be correct in which institution with real cases.

RISK BASED APPROACH

Classifies suppliers according to criticality.

Classify suppliers based on data sensitivity, system access, financial dependency and operational criticality factors; Applying different depth of control to each class.

  • Criticality criteria matrix
  • Link with data classification
  • Audit depth by class
QUESTION LIST DESIGN

Creates a list of questions tailored to the supplier.

Audit form design consisting of supplier-specific, real information and unskippable questions, using SIG, CAIQ, ISO 27001 Annex A, KVKK and sectoral references.

  • Using SIG and CAIQ
  • Standard reference mapping
  • Sectoral adaptation
ON-SITE INSPECTION

How to inspect in the field, what to look for.

We work with the discipline of on-site audit preparation, opening meeting, evidence collection, interview technique, system review, closing meeting and audit report writing.

  • Opening and closing discipline
  • Evidence collection protocol
  • Interview and observation techniques
CONTRACT AND LAW

It secures the right to audit by contract.

Information security clauses that need to be added to the contract, right to audit, KVKK data processor contract, violation notification periods and contract termination obligations are discussed in detail.

  • Information security clauses
  • KVKK data processor agreement
  • Breach notification provisions
CONTINUOUS İZLEME

Turns annual auditing into continuous monitoring.

Continuous monitoring components such as automatic threat intelligence, external security scoring services, breach news tracking, financial health monitoring and contract cycle are installed.

  • External scoring services
  • Breach intelligence tracking
  • Automatic trigger rules
FINDINGS MANAGEMENT

It turns the finding into action, not a report.

Bulgu sınıflandırma kriterleri, remediation plan talebi, sürelere bağlı eskalasyon, szleşme yenileme kararına etkisi ve ynetim raporlamasında nasıl kullanılacağı işlenir.

  • Finding prioritization criteria
  • Closing tracking cycle
  • Management reporting format
TRAINING FLOW

İki günlük yoğun program; inventoryden sürekli izlemeye kadar tüm TPRM yaşam dngüsünü kapsar.

Program; It can be adapted as a 1-day summary, 2-day implementer or 5-day auditor competency depending on the institution's supplier maturity and participant profile. The entire flow is supported by practical workshops.

01Tedarikçi inventory ve sınıflandırmaThe institution's supplier list is drawn up; Classification is made according to data sensitivity, system access, criticality and financial dependency.
02Legislation and standards mapISO 27001 Annex A 5.19-5.23, KVKK data processing, BRSA Information Systems and EBA external resource management requirements are mapped.
03Contract and entry phaseWhen entering a new supplier, pre-evaluation, items that need to be added to the contract and the design of the KVKK data processor contract are studied.
04Question list designUse of SIG, CAIQ and custom questionnaires; customization by supplier class; The discipline of supporting answers with evidence.
05On-site inspection methodOpening meeting, evidence collection, interview technique, system and physical control review, closing meeting and reporting.
06Finding classification and closureBulguların kritiklik düzeyine gre sınıflandırılması, remediation plan talebi, eskalasyon yolları ve szleşme dngüsüne etkisi.
07Continuous monitoring and external scoringIntegration of threat intelligence, external security scoring services, breach news and financial health monitoring within the organization.
08Management reporting and roadmapTop management TPRM dashboard, key risk indicators, annual supplier report and 90-day TPRM roadmap specific to the participating organization.
TRAINING MODULES

Legislation, methodology and continuous monitoring come together in one program.

M1
TPRM basics and legislation mapIntegrated mapping of third party risk management concept, ISO 27001 Annex A 5.19-5.23, KVKK data processing, BRSA and EBA outsourcing management requirements.
M2
Tedarikçi inventory ve sınıflandırmaSupplier life cycle, criticality criteria matrix, connection with data sensitivity, practical installation of classification matrix.
M3
Question list and standard referencesSIG, CAIQ, ISO 27001, SOC 2 references; adapting the question list according to the class; The discipline of supporting answers with evidence.
M4
On-site inspection methodologyPreparation, opening, evidence collection, interview technique, system and physical control review, closing and audit report writing.
M5
Contract, law and KVKKInformation security conditions, right to audit, KVKK data processing agreement, violation notification periods, contract termination obligations and data destruction discipline.
M6
Continuous monitoring, findings and reportingExternal scoring services, threat intelligence, finding classification, closing monitoring, executive dashboard and KPI design.
DOMALI ATÖLYELER

Training makes learning permanent through real supplier cases and audit reports.

Participants don't just listen; They classify suppliers, adapt a list of questions, play interviews, collect evidence, write a findings report and create a road map for their own organizations.

CLASSIFICATION WORKSHOPSupplier criticality map50 suppliers of a sample organization are classified; data sensitivity, system access and operational criticality factors apply.
QUESTION LISTClass-specific form designSeparate question sets are designed for high, medium, and low criticality vendors; It maps to SIG and CAIQ.
MÜLAKATOn-site audit interviewAn interview with a cloud provider representative is simulated; correct questions, request for evidence and follow-up questions are practiced.
EVIDENCE TOPLAMADocument and system reviewValidity evaluation is made through policy documents, system screenshots, record samples and certificates.
FINDING REPORTClassification and escalationTespit edilen 10 rnek bulgu kritiklik düzeyine gre sınıflandırılır; remediation plan ve eskalasyon yolu belirlenir.
ROADMAP90-day TPRM planA road map consisting of maturity determination, quick wins and continuous monitoring steps is prepared for the participating institutions.
WHO SHOULD JOIN

Adaptive training for all critical decision-making roles at any stage of the supplier lifecycle.

Information Security and TPRM Officers
Internal Audit Experts
Risk Managers
Purchasing and Contract Management
Legal and KVKK Officers
Compliance Unit
IT and System Administrators
Quality and Process Management
ÇIKTILAR

At the end of the training, the supplier audit maturity of the institution becomes measurable and sustainable.

Participant gains

  • Tedarikçi inventoryni doğru kriterlerle sınıflandırabilme
  • Ability to use SIG, CAIQ and special question lists effectively
  • Ability to perform on-site inspections and collect evidence
  • Getting real information through interview technique
  • Ability to classify findings and report
  • Ability to add information security clauses to contracts
  • Ability to establish a continuous monitoring process

Institutional outputs

  • Supplier classification matrix template
  • Class-specific question list sets
  • On-site inspection checklist
  • Contract information security clauses library
  • KVKK data processor agreement template
  • Finding classification and reporting format
  • Top management TPRM dashboard KPI list
  • 90-day TPRM road map specific to the institution
EDUCATION IDENTIFICATION

Everything you want to know about education at a glance.

Duration, format, number of participants, certificate, content scope and delivered materials have been clarified. In institution-specific programs, parameters are adapted according to need.

2 GÜN
Training Duration 14 Hours / 2 Full Days 1-day summary or 5-day auditor competency option depending on the maturity of the institution.
FORMAT
Training Format Face to Face or Online Classroom training at the institution location, online live session or hybrid structure.
CERTIFICATE
Certification Certificate of Participation OKlayan tüm katılımcılara Secure Fors imzalı dijital sertifika.
DİL
Language of Education Türkçe English training and material presentation upon request.
Training NameSupplier Audit Training (TPRM — Third Party Risk Management)
Süre2 days (14 hours). It can be adapted as a 1-day summary or 5-day auditor competency program depending on the maturity of the institution.
Training Format Face to Face (Institution Location) Online Live (Zoom / Teams) Hibrit
Training TopicsTPRM fundamentals · Supplier life cycle · ISO 27001 Annex A 5.19-5.23 · KVKK data processor obligations · BRSA and EBA outsourcing management · Supplier classification matrix · SIG and CAIQ usage · On-site audit methodology · Interview technique and evidence collection · Contract information security clauses · Finding classification · Continuous monitoring · Upper management reporting.
Target AudienceInformation security and TPRM officers, internal audit experts, risk managers, purchasing and contract management, legal and KVKK officers, compliance unit, IT and system managers, quality and process management.
PrerequisiteBasic knowledge of ISO 27001 and KVKK is recommended; but it is not mandatory. The content is highly adaptable for participants with internal audit experience.
Number of ParticipantsOptimum verim için 8 – 20 kişi. Kuruma zel programlarda en fazla 25 kişiye kadar grup açılabilir.
Sertifika Certificate of Participation When the training is completed, a signed digital participation certificate is issued by Secure Fors. Contains verifiable QR code.
Educational MaterialPresentation file (PDF) · Workshop workbook · Supplier classification matrix template · Class-specific question list sets · On-site audit checklist · Contract information security clauses library · KVKK data processor contract template · Finding classification and reporting format · Top management TPRM dashboard KPI list · 90-day TPRM roadmap template.
UygulamaSupplier classification workshop includes class-specific question list design, on-site audit interview simulation, document and system evidence review, findings classification and escalation discussion, 90-day road map design workshops.
EğitmenISO 27001 Lead Auditor, CEH ve TPRM alanında deneyimli kıdemli danışman. Türkiye’nin nde gelen havayolu, banka ve teknoloji şirketlerinde tedarikçi denetimleri yürütmüş; sahada uygulanabilir metodoloji odaklı.
PricingSpecial offer for the institution. The price is determined according to the number of participants, format (face-to-face / online), program duration and customization need.
FREQUENTLY ASKED QUESTIONS

Answers to questions you may have before the training.

We have no internal audit experience, is the training suitable for us?

Yes. The training explains basic audit techniques in plain language for participants who do not have internal audit experience. Competencies such as question list design, interview technique and evidence collection are taught from scratch. If there are experienced participants, the content is adapted to a higher level.

Our organization does not have ISO 27001 certification, do we still need to do TPRM?

Evet. KVKK veri işleyen yükümlülükleri, BDDK ve EBA düzenlemeleri, sektrel uyum şartları ve müşteri szleşmelerindeki yükümlülükler ISO 27001’den bağımsız olarak tedarikçi denetimini gerektirir. Eğitim, ISO 27001 olmadan da TPRM kurmayı ğretir.

Can we directly use question lists such as SIG, CAIQ?

These standard questionnaires are useful to get started, but need to be tailored to the organization's industry, supplier profile and risk appetite. The training teaches this adaptation methodology; It is supplied with sample sets tailored specifically to the institution.

Is on-site inspection mandatory for every supplier?

No. Risk bazlı yaklaşımda yalnızca yüksek kritiklik sınıfındaki tedarikçilerde yerinde denetim yapılır. Orta sınıf için video konferanslı denetim, düşük sınıf için soru listesi yeterli olabilir. Eğitim, hangi sınıfta hangi yntemin uygun olduğunu somut kriterlerle gsterir.

If the supplier has a SOC 2 report, do we not need to conduct an audit?

The SOC 2 report is a powerful reference, but it is not enough on its own. The scope of the report, its validity date, audit type (Type 1 / Type 2) and whether it covers controls related to you should be evaluated separately. The tutorial teaches you how to read third-party reports.

Are continuous monitoring services (BitSight, SecurityScorecard, etc.) alone sufficient?

No, bunlar dış grünür security durumunu lçer; iç kontrol kalitesini lçmez. Continuous monitoring servisleri yıllık denetim yerine değil, yıllık denetimi tamamlayıcı bir araç olarak kullanılır. Eğitim, bu servislerin doğru entegrasyonunu ğretir.

Transform supplier auditing from sending a list of questions into a measurable control discipline.

Make your audit maturity sustainable with TPRM training tailored to your organization's sector, supplier profile and risk appetite.

Request a Training Plan

Reference frames: ISO/IEC 27001:2022 Annex A 5.19-5.23 Tedarikçi İlişkileri Controlleri · ISO/IEC 27036 Tedarikçi İlişkileri için Bilgi Güvenliği · NIST SP 800-161 Tedarik Zinciri Risk Ynetimi · 6698 Sayılı KVKK ve Veri İşleyen Yükümlülükleri · BDDK Bilgi Sistemleri ve Elektronik Bankacılık Ynetmeliği · EBA Outsourcing Arrangements Rehberi · Shared Assessments SIG · Cloud Security Alliance CAIQ.