Free scorecard
EVIDENCE: exam and audit readiness scorecard
Eight questions to ask yourself before the examiner or auditor does. A one-page scorecard from Third Party Threat Hunting (TPTH) for banks, credit unions and other regulated institutions.
Three questions, eight letters
Program, proof and explanation
Exam and audit readiness comes down to three questions. EVIDENCE sorts the eight things to check under them.
1. Program
Do you have one at all? What exactly will you be measured against?
2. Proof
Can you show you followed it, consistently?
3. Explanation
Can you explain every exception in plain business English?
E Expectations known
What exactly will you be measured against?
Program
V Vendors inventoried
Do you know who your vendors are and what they touch?
Proof
I Issues and exceptions explained
Do you know your gaps, and why you ever departed from your own procedure?
Explanation
D Documents current
Are your policies approved, versioned and reviewed on schedule?
Program
E Evidence logged
Can you prove each control actually ran, on time?
Proof
N Named owners
Does every control have one person responsible?
Program
C Controls challenged
Have you tested that your controls actually work?
Proof
E Easy to explain and retrieve
Could you hand over a package fast and walk someone through it?
Explanation
The scorecard gives you, for every letter, what a Yes looks like and what a No looks like. A readiness tool, not a regulatory standard or legal advice. It does not predict or guarantee any exam result.
How to score it
Answer for what you could show tomorrow
Answer Yes, Partly or No for what you could show tomorrow, not what you plan to do. Mostly Yes: you can show program, proof and reasoning, so keep logging. Several No: start with Program (Expectations known, Documents current, Named owners), then build Proof. Close the Partly answers in Proof first.
The two to watch: Documents current is what you say you do. Evidence logged is proof you did it. The gap between them is the one to close first.
Before an exam
Preparing before the examiner arrives
Third Party Threat Hunting (TPTH) helps regulated institutions prepare before an exam or audit.
That is preparation, not assurance: we do not promise an exam result and this is not legal advice. To talk about pre-exam preparation for your institution, tick the call box below or email info@thirdpartythreathunting.com.
Get the scorecard
Free, with your work email
We email the PDF straight away.
The scorecard is on its way
The scorecard is on its way to your inbox. If it does not arrive within a few minutes, check your spam folder.
What happens next
The scorecard arrives by email within a few minutes, as a PDF you can print or fill in. That is the only email you get for it.
We keep your email address, and the optional details you give, to send the scorecard and to follow up on a call if you ask for one. No tracking of opens or clicks. Privacy Notice →