Both options are possible, and the decision is based on risk. Remote audits are faster and more cost-effective and are sufficient for document and process reviews. On-site audits are worthwhile where physical security, access controls, or production environments are a factor.

Supplier Audits (2nd Party Audits)

Q: Why do ISO 27001 and the BSIG require supplier audits?

Because risks enter the company through the supply chain. ISO/IEC 27001:2022 addresses supplier relationships in Annex A, and Section 30 of the BSIG explicitly lists supply chain security as one of the ten categories of risk management measures. Remote access and third-party administrative privileges are the most critical issues here.

Q: Do we have to audit every service provider?

No. The effort required depends on the risk: Anyone who has remote access to your systems or processes sensitive data is audited; a supplier without system access usually is not. A risk-based classification of the service provider landscape is the first step and saves the majority of the effort.

Security throughout your supply chain – transparent, verifiable, and robust

Your service providers are an integral part of your value chain – and at the same time one of the biggest vulnerabilities to your information security. Whether it’s remote access, administrative privileges, or the processing of sensitive data: risks often arise where transparency is lacking.

Second-party audits create precisely this transparency. They systematically verify how securely your service providers actually operate – and uncover vulnerabilities before they turn into incidents.

Typical risks without an audit:

uncontrolled remote access to your systems
lack of security policies at the service provider
insufficiently protected customer data
lack of compliance with ISO 27001, KRITIS, NIS-2, or TISAX®

Your benefits at a glance

With professionally conducted 2nd-party audits, you’ll achieve:

clear risk transparency across your service provider landscape
demonstrable compliance with auditors and regulatory authorities
Reducing liability and reputational risks
Strengthening trust among customers and partners
A solid basis for decision-making regarding supplier evaluations

Why audits conducted by external auditors are the better approach

External auditors offer a crucial advantage: true independence. No internal conflicts of interest, no tunnel vision – just an objective view of your service providers and their security levels.

In addition, you benefit from:

Insights gained from numerous audit projects
Best practices from various industries
Up-to-date knowledge of regulatory requirements
Efficient execution without tying up internal resources

Here’s how a 2nd-party audit works

Our proven audit approach is structured, efficient, and practical:

Defining objectives
Clear definition of the scope of the audit, protection needs, and requirements

Audit planning
Customized audit program, including methodology and timeline

Execution
On-site or remotely – analysis of processes, systems, and controls

Evaluation & documentation
Transparent presentation of all findings and risks

Recommendations for action
Specific, prioritized recommendations for action to minimize risk

Final report & follow-up
Management-oriented report, including support for implementation

abat – Your partner for effective supplier audits

With abat, you can rely on experienced specialists in information security and auditing.

Certified ISO 27001 auditors
Extensive experience in KRITIS, TISAX®, and ISO environments
A practical approach rather than theoretical checklists
Focus on actionable results and real added value

Our mission: not just to audit, but to improve.

We help you identify risks early on, secure your supply chain for the long term, and ensure audit readiness at all times.

Turn your service providers into a controlled security asset – not a risk.

FAQs

What Is a Second-Party Audit?

An audit of a supplier or service provider conducted by the client or on the client’s behalf. The audit is typically prompted by concerns regarding how securely a service provider handles your data, access credentials, and systems. The results are incorporated into supplier evaluations, contract drafting, and risk analysis.

Why do ISO 27001 and the BSIG require supplier audits?

Do we have to audit every service provider?

On-site or remote?

TISAX^® is a registered trademark of the ENX Association. The mention of the TISAX^® trademark does not imply any statement by the trademark owner regarding the suitability of the services advertised here. The exclusive responsibility for the content of the website and the services presented here lies with abat.

Our customers in the area protect

Saskia

ISMS Consultant
Bremen

For me, abat is: fun, exciting projects - great customers and colleagues packed into a respectful and trusting atmosphere with plenty of room for continuous development!