Beyond Vendor Oversight: Contract Compliance as a Pillar of Third-Party Risk Management
IIA Calgary Chapter | Sept 8, 2026 |
To be presented by Jaeson Jaman, CPA, CMA — Partner, Enterprise Risk Services, MNP
Session synopsis
With the IIA's Third-Party Topical Requirement taking effect September 15, 2026, internal audit functions should be preparing now to address new expectations while leveraging the opportunity to add greater value through third-party risk assurance.
This session reframes contract compliance as a core pillar of third-party risk management, not an after-the-fact clean-up exercise. Jaeson unpacks what the new requirements actually demand - lifecycle coverage from selection through offboarding, defined minimum procedures, and documentation that stands up to quality review and shows how to build a program that management actually uses.
What attendees will take away
- A clear read on the new requirements — applicability rules, mandatory elements across governance, risk and controls, and the documentation expectations reviewers will test
- The full risk picture — how third-party exposure spans financial, operational, compliance, reputational and strategic risk
- Quick wins that build momentum — rebates and discounts, payroll burden, rate validation, SLA and contract clause reviews, duplicate and overtime analytics
- The shift from old school to new school — moving from sample-based, manual, retrospective audits to analytics, AI and real-time monitoring across full contract populations
- The value case for internal audit — typical recoveries of 1–5% of audited contract value, plus stronger board confidence and faster program maturity
Why attend
Drawing on contract compliance work across $10B+ capital programs in oil and gas, power, mining and the public sector, Jaeson shares real engagement examples — including where structure was missing and what it could cost.
Who should attend: internal audit, finance, procurement and supply chain leaders responsible for third-party risk, vendor oversight, or preparing for the September 2026 requirements.