Article
What is SRM in audit? Define the scope before testing suppliers
Clarify SRM in an audit brief, distinguish supplier relationships from supplier risk, and trace an outsourced-service issue from evidence to management action.
Contrata editorial team ·
An audit request arrives with the subject “SRM review”. Procurement starts collecting supplier scorecards. Risk starts collecting assessments. Both teams may be preparing sensible evidence for different questions.
Before requesting another folder of documents, expand the acronym in the engagement scope and state what the audit will test. The label alone does not identify the process, criteria or accountable owner.
What is SRM in audit?
In a procurement or supplier-management audit, SRM can mean supplier relationship management: how the organisation manages its relationships with suppliers to achieve the intended outcomes. The Chartered Institute of Procurement & Supply's procurement cycle uses SRM in that sense. An audit may examine whether those arrangements are designed appropriately and operate as intended.
Do not assume that expansion applies to every audit brief. A risk team may be using SRM as local shorthand for supplier risk management, or another process may use the same initials. Check the audit plan, approved policy and process owner's definition. Write the full term in the agreed scope before selecting evidence.
For example, “Audit of supplier relationship management for outsourced claims administration, covering performance review, issue escalation and action closure during the defined review period” is more testable than “Audit of SRM”. The period and criteria still need to be specified. This is a suggested scope statement, not an auditing standard.
Separate the relationship, the risk and the assurance
Supplier relationship management asks how the organisation works with the supplier: objectives, performance discussions, communications, improvement and disagreements. CIPS's supplier-management guidance connects post-contract management with feedback on performance and the working relationship. It provides professional procurement context, not Australian prudential requirements.
Supplier risk management asks what could prevent the service from meeting the organisation's needs, which controls address that exposure, and what remains unresolved. Third-party risk management, or TPRM, places that work within a broader programme of third-party oversight. Define the boundaries in your own framework; renaming a folder does not establish that its risks are managed.
Internal audit provides independent assurance and advice about governance, risk management and controls. The IIA's Three Lines Model, updated September 2024, distinguishes that role from management's responsibility for managing risk. Audit can challenge how an issue was handled without becoming the person responsible for fixing the supplier service.
| Work being examined | Useful audit question | Evidence that makes the question testable |
|---|---|---|
| Relationship and performance | Were agreed service problems discussed and followed through? | Service criteria, dated reviews, underlying performance records and action history. |
| Supplier risk | Did the team assess the operational consequence and unresolved exposure? | Service-specific scenarios, evidence boundaries, current controls and decision rationale. |
| Management action | Did someone with authority decide what to do and retain ownership? | Delegation, decision, conditions, owner, due date and completion evidence. |
| Independent assurance | What did audit examine, find and report within its scope? | Agreed scope, criteria, testing record, findings and reporting. |
One document can contribute to several questions. It should not be treated as proof of every process merely because it is filed in a common evidence folder.
Work through one outsourced claims issue
Consider a fictional insurer, Harbour Mutual, reviewing an outsourced claims administrator. Its supplier scorecard is green because the provider met an agreed file-delivery target. The insurer's reconciliation record shows that some delivered files could not be loaded without manual repair. All names, records and outcomes in this example are invented.
The relationship owner has evidence of delivery performance. That evidence does not establish that the insurer could complete claims processing. The risk reviewer needs to understand the unusable files, affected work, duration and workaround. The audit question is whether the organisation's process recognised and acted on that difference.
An illustrative evidence trail would connect:
- The definition of the file-delivery target and its exclusions.
- The provider's dated delivery record and the insurer's corresponding load results.
- The issue raised about unusable files, including what was and was not known.
- Management's service-impact assessment, decision and assigned corrective action.
- Evidence used to verify the correction, or the reason the issue remains open.
Suppose management has requested a mapping correction but has not yet inspected a successful load result. The defensible record says that the correction is requested and verification is outstanding. A completed supplier meeting is evidence that a discussion occurred. It does not demonstrate that the files now work.
Audit can test those links and report a weakness. The service owner still coordinates remediation, and the authorised management decision-maker determines whether and under what conditions the service continues. The small-team ownership guide helps assign those responsibilities without assuming that L1/L2/L3 has one meaning everywhere.
Apply CPS 230 to the arrangement, not the acronym
For an APRA-regulated entity, CPS 230 requires the internal audit function to review proposed material arrangements involving the outsourcing of a critical operation. It also requires regular reporting to the Board or Board Audit Committee on those arrangements' compliance with the entity's service provider management policy. Those are specific obligations with a defined scope, not a rule that every supplier needs an identical “SRM audit”.
Assess the actual service and arrangement against the current standard. A lean insurer or super fund does not acquire a different regulatory classification merely because it has fewer than 200 staff. Use the provider-versus-arrangement guide when that classification needs separate work.
Make the evidence request specific
For a small team, a bounded request is easier to complete and inspect than a request for everything labelled SRM. Agree these fields with the audit team:
Full process name and definition:
Service, arrangement and process owner:
Audit objective, criteria and review period:
Population and records requested:
Evidence reference, scope and date:
Known exclusions or missing records:
Management decision and action owner:
Verification required before action closure:
Audit finding and reporting reference, where applicable:
This is a suggested preparation record. The audit team determines its procedures and evidence needs. Preserve unresolved issues and authorised access boundaries; a convenient handover does not justify sharing restricted supplier or customer information more broadly.
The supplier decision-record guide helps retain management's reasoning. The assurance-report review guide addresses a different question: how much reliance to place on a supplier's external assurance report. Neither a green scorecard nor an external report substitutes for evidence that your own issue was resolved.