Annual IIA South West Ontario (SWO) Symposium: Vendor Risk Management

Session Overview

This full-day hybrid event features four sessions covering the end-to-end vendor management lifecycle. Join us in person for the full day or attend online.

Session 1: Establish Governance & Accountability

Participants will explore how to define clear roles and accountabilities across the three lines of defence, including the responsibilities of business owners, procurement, risk management, and senior management. The session will cover how to establish appropriate governance structures, policies, and escalation paths, how to tier vendors based on criticality and inherent risk, and how to report meaningful vendor risk information to senior management and the Board. Attendees will leave with a practical understanding of what “good” governance looks like and how to embed accountability for vendor risk throughout the organization.

• Sandeep Dani, Partner, KPMG Canada
• John Preiato, Executive Director, Regulatory and Risk Advisory

Session 2: Execute Effective Oversight & Performance Monitoring

Participants will learn how to establish meaningful performance metrics and service level expectations, and how to use them to identify early warning signs of vendor deterioration. The session will explain how to critically review System and Organization Controls (SOC) reports, assess the relevance of exceptions and carve-outs, and confirm that complementary user entity controls (CUECs) are in place and operating effectively within the organization. Attendees will also gain insight into identifying and monitoring fourth- and nth-party dependencies, and into establishing clear processes for escalating, tracking, and closing vendor issues in a timely manner.

• Michael Kostanecki, Director, Technology Risk and Audit Services, Protiviti
• Tarun Dhawan, Associate Director, Technology Audit, Internal Audit and Financial Advisory, Protiviti

Session 3: Assess & Document Vendor Risk Across the Lifecycle

Participants will examine how to perform proportionate, risk-based due diligence during vendor selection and onboarding, and how to reassess risks whenever the relationship, services, or threat landscape changes. The session will address emerging areas of concern, such as the use of artificial intelligence (AI) by vendors, data residency and privacy obligations, and concentration risk. Attendees will learn how to document risk assessments, risk acceptance decisions, and contractual protections in a clear and consistent manner, as well as how to plan for exit strategies and business continuity when a vendor relationship ends or fails.

• Sonu Sikand, Partner and National Third-Party Risk Management Leader, KPMG Canada

Session 4: Demonstrate Audit-Ready Governance

Participants will learn what internal auditors and regulators, including the Office of the Superintendent of Financial Institutions (OSFI) under Guideline B-10, typically expect to see when assessing third-party risk management programs. The session will cover how to maintain complete and accurate vendor inventories, retain sufficient evidence of due diligence, monitoring, and issue remediation, and demonstrate that controls are operating effectively over time. Attendees will also discuss common audit findings and practical steps to close gaps, strengthen documentation, and build a sustainable, audit-ready vendor management program.

• Suk Bedi, Executive Director, KPMG Canada
• Dinaish Singh, Partner, KPMG Canada

CPE Credit: 5.0