What evidence do auditors commonly ask for on CPS 234 para 34 Internal audit assessment of third-party assurance?

Internal audit working papers assessing third-party assurance reports (scope, period, opinion, exceptions); List of third parties where internal audit relies on external assurance, with materiality rationale; Reliance methodology in the internal audit manual; Records of follow-up where third-party assurance was insufficient; Audit committee reporting on reliance placed on third-party assurance.

What is the most common gap auditors find on CPS 234 para 34?

Internal audit accepts third-party reports without any evaluation

APRA CPS 234 · Internal audit (paras 32 to 34)

`CPS 234 para 34` Internal audit assessment of third-party assurance

Internal audit has to assess the security control assurance a related or third party provides where both hold: (a) an incident affecting the assets could have a material financial or non-financial effect on the entity itself or on the interests of its depositors, policyholders, beneficiaries or other customers (the materiality limb); and (b) internal audit plans to rely on that party's assurance. A footnote extends this to all such parties, not only CPS 231 or SPS 231 material outsourcing.

Source: APRA CPS 234, CPS 234 para 34. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open APRA CPS 234 in the compliance library.

Applies to APRA-regulated entities.

artefacts

held by a system

at each review

hard

to go live

Vendor register / contract repository

where the evidence lives

teal = a system already holds it · olive = produced at each review. To go live: easy when half or more of the artefacts are already held by a system, moderate from a quarter to a half, hard below a quarter.

These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.

system holds itEvidence a system already holds

none for this control

periodic reviewEvidence produced at each review

Internal audit working papers assessing third-party assurance reports (scope, period, opinion, exceptions) · Vendor register / contract repository
Records of follow-up where third-party assurance was insufficient · Vendor register / contract repository

governing documentDocuments that govern the control

List of third parties where internal audit relies on external assurance, with materiality rationale · Vendor register / contract repository
Reliance methodology in the internal audit manual · Policy repository / GRC workspace
Audit committee reporting on reliance placed on third-party assurance · Vendor register / contract repository

First move

No system holds this evidence for you: it is people and documents. Reminders and routing to the owner still save time. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date.

Common gaps auditors find

Internal audit accepts third-party reports without any evaluation
Materiality of third-party assets never assessed before deciding to rely
Report periods or scope do not cover the services the entity uses

Do this for your whole sheet

Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.

Build my evidence sheet

CPS 234 para 33 Skilled personnel for control assurance · CPS 234 para 35 Notify APRA of material incidents within 72 hours