THE CHALLENGE

A large multinational insurer engaged InConsult to strengthen its third party risk management (TPRM) program and gain a transparent, year-on-year view of vendor information security capability, modern slavery obligations and operational risk management processes. Key drivers included: clearer alignment with prudential regulation expectations for service-provider oversight (APRA CPS 234/230), better evidence collection aligning with auditing standards and to provide sufficient assurance, and external visibility of vendors’ exposed attack surface through vulnerability assessments.

The existing process included basic questionnaires and some attestations, but lacked:

• independent passive vulnerability / external attack-surface visibility,

• bespoke assurance questionnaires tuned to different vendor tiers and services,

• consistent evidence trails for control verification, and

• comparative reporting showing cohort trends and year-on-year changes.

OUR APPROACH

We delivered a comprehensive, evidence-based third party risk management uplift including the complete end-to-end facilitation of the program to truly define supply-chain risk:

• Program Design & Standards Alignment: Mapped the insurer’s TPRM processes to APRA CPS 234 (information security, including third parties) and CPS 230 (operational risk and service providers), and considered international supply-chain standards (e.g. ISO/IEC 27036) to structure controls, evidence and assurance activities.
• Third Party Ecosystem, Tiering & Bespoke Assessments: Confirmed vendor details, services, data sensitivity and criticality, assigned tiers and set tier-based assessments combining questionnaires, workshops, external scanning and targeted evidence requests (e.g., ISO 27001 certificates, penetration test reports, backup/MFA configurations).
• Passive Vulnerability Scanning of External Attack Surface: Performed non-intrusive scanning to identify exposed services, weak configurations and stale assets for in-scope vendors, aligned with the Open Worldwide Application Security Project (OWASP) vulnerabilities database. Findings fed into each vendor’s risk profile and remediation recommendations.
• Bespoke Assurance Questionnaires: Built tier-specific questionnaires leveraging prudential standard requirements that the insurer is required to comply with internally and across their supply chain. Designed scoring and an easy-to-follow risk rating matrix for identified weaknesses.
• Facilitated Workshops & Evidence Collection: Ran multi-hour workshops with high-dependency vendors to validate responses, walk through configurations, and agree remediation timelines. Collected artefacts to create defensible audit-quality workpapers mapped to each control and risk theme.
• Reporting, Scoring & Trend Analysis: Issued a customised report to each vendor and a portfolio summary report for the insurer showing cohort performance, heat-maps, trend lines versus prior years, and prioritised recommendations. Prioritised residual risks based on severity, regulatory implications, costs, time to rectify and our experience as risk management experts.

OUTCOMES & BENEFITS

As a result of our engagement:

• Enterprise-Wide View of Third-Party Risk
  A consolidated view and summary report covering all vendors with tier-based grades, material issues, and remediation status, supporting executive and audit/risk committee oversight.

• Independent External Visibility
  Passive scanning surfaced misconfigurations and exposed services missed by self-attestations, enhancing remediation and reducing time-to-detect for vendor weaknesses.

• Stronger Evidence & Assurance
  Complete workpapers tied to recognised supply-chain standards to give internal audit and regulators confidence in the control assessments.

• Year-on-Year Comparability
  Vendor and cohort trend analysis showed measurable improvement against the previous year, with risk-based sequencing of “next best” actions per vendor.

• Trusted Partnership
  The structured, transparent approach strengthened the insurer’s confidence in InConsult as a trusted provider for ongoing third party risk management assurance and uplift initiatives.

Would you like to know more about our cyber resilience services? Contact us today.

This case study is drawn from a real-life engagement/project between InConsult and our client. While client details are not disclosed for commercial and confidentiality reasons, this case study is based on a real engagement and reflects genuine results and outcomes. Specific client references and project details can be shared with prospective clients during the proposal process.

THE CHALLENGE

A NSW Local Government agency serving more than 40,000 residents within a high-density region wanted independent assurance over its cyber posture and a clear, evidence-based path to reach its targeted Essential Eight (E8) Maturity Level One as set out in its Information Security Strategy. The agency needed an audit aligned to the Cyber Security NSW – Cyber Security Guidelines for Local Government and to be assessed against the Australian Signals Directorate (ASD) Essential Eight assessment guidelines, so executives and auditors could rely on the results for planning and reporting.

For the Local Government agency, this was the first ever comprehensive E8 audit that would reveal any potential shortfalls after many months of uplift and late nights.

OUR APPROACH

InConsult delivered a structured audit and assessment program combining workshops, technical validation and comprehensive documentation:

• Scoping & Alignment: Defined the audit scope against the Cyber Security NSW – Local Government Guideline control set and mapped each control to the ASD Essential Eight maturity criteria and assessment methods.

• Facilitated Multi-Hour Workshops: Ran detailed, multi-hour workshops with IT Operations to:

  • Validate current state for the eight mitigation strategies (application control, patching applications/OS, Microsoft Office macro settings, user application hardening, restricting admin privileges, MFA, and backups).

  • Elicit evidence paths, data sources and system configurations for each target control.

  • Agree on required evidence, sampling volumes and special terms for review of highly sensitive content.

• Evidence-Based Testing & Workpapers: Executed ASD-aligned assessment procedures (configuration reviews, sample-based testing, artifact walkthroughs and spot checks). Produced complete audit workpapers directly aligned to ASD’s Essential Eight Assessment Process Guide, including test steps, results, screenshots and residual risk notes, creating a robust audit trail from requirement to evidence.

• Findings, Ratings & Roadmap: Issued an audit report with clear control ratings, maturity mapping, and remediation recommendations prioritised by risk, effort and dependencies.

OUTCOMES & BENEFITS

As a result of our engagement:

• Target Achieved: Essential Eight Maturity Level One: The agency achieved E8 Maturity Level One, meeting its strategic target with documented, repeatable evidence aligned to ASD guidance, providing confidence to executives, audit & risk committee members and external stakeholders.
• Assurance Over Guideline Alignment: Verified alignment to the Cyber Security NSW – Local Government Guideline, strengthening their policy-to-control traceability and reporting confidence.
• Clear, Actionable Remediation: Prioritised remediations sharpened focus on near-term controls (e.g., admin privilege management, MFA coverage and backup processes).
• Strengthened Partnership: The quality of our workpapers, facilitation and practical recommendations enhanced our standing as a trusted provider, setting the foundation for ongoing advisory and periodic reassessments.

Would you like to know more about our cyber resilience services? Contact us today.

This case study is drawn from a real-life engagement/project between InConsult and our client. While client details are not disclosed for commercial and confidentiality reasons, this case study is based on a real engagement and reflects genuine results and outcomes. Specific client references and project details can be shared with prospective clients during the proposal process.