Author: admin

Your next big risk isn’t inside your building

Hi {{ .Subscriber.FirstName }},

Most audit failures don’t start where you’re looking.

Here’s the thing about third-party risk. Your controls can be airtight and your team sharp, and you can still get taken down by a vendor you onboarded three years ago, under a contract you didn’t write, sitting in an inventory nobody’s fully reconciled. The risk lives outside your walls, but it’s still your name on the assurance.

The good news: vendors tend to break down in predictable places. Weak due diligence. Data-sharing gaps. Access rights nobody revoked. Monitoring that quietly stopped after onboarding.

Once you know where to look, third-party oversight goes from sprawling to scopeable. The Risk Register is where we hand you the practical stuff we wish someone had handed us earlier.

So here’s where to start, and it’s free.

🌟 START HERE: FREE WORKBOOK + LIVE CPE SESSION

Two things, same topic.

1. Grab the workbook (free):

Free, and it counts toward CPE

Practitioner’s Workbook: Third-Party Risk Topical Requirement

A working guide through the full vendor life cycle: due diligence, data sharing, access rights, and ongoing monitoring. Built to sit next to you while you scope the engagement.

Download it here!

Practitioner's Workbook: Third-Party Risk Topical Requirement

2. Then come do it live on July 15th!

Free, and it counts toward CPE

Third-Party Risk: The Places Where Vendors Usually Break Down

Mike walks through where vendor problems actually start and how to test the full vendor life cycle- live, virtual, and free.

NASBA CPE | Field of Study: Auditing | Basic | No prerequisites.

Join here!

⚡️ALSO WORTH YOUR TIME

When you’re ready, there’s more… and again, all free!

The rest of the Practitioner’s Workbook series (Cybersecurity, Organizational Behavior, and Organizational Resilience (soon) Topical Requirements) – Download the rest here.
On-demand replays and past training, anytime. Watch it here.

Over the past two years, we’ve presented to roughly 100,000 internal audit professionals. Most of our monthly CPE webinars are free; a few are paid deep-dive sessions. The default is free, and this one is.

See you on the 15th!

Mike Levy

CIA, CRMA, CISSP, CISA, CDPSE, MBA

CEO & Managing Principal

Cherry Hill Advisory

Cherry Hill Advisory is a global risk advisory firm serving internal audit and risk leaders across every industry. We help organizations strengthen audit quality, address emerging risk, and meet rising expectations from audit committees, regulators, and stakeholders. Our team works with organizations on external quality assessments, internal audit cosourcing, training, fraud risk, and strategic risk advisory.

Cherry Hill Advisory is registered with the National Association of State Boards of Accountancy (NASBA) as a sponsor of continuing professional education on the National Registry of CPE Sponsors.

State boards of accountancy have final authority on the acceptance of individual courses for CPE credit. Complaints regarding registered sponsors may be submitted to the National Registry of CPE Sponsors through its website: www.nasbaregistry.org.

Reach out to us

info@cherryhilladvisory.com ● www.cherryhilladvisory.com

900 Haddon Avenue, Suite 300-1 | Collingswood, NJ 08108

Follow us on LinkedIn

Update your preference | Unsubscribe | Contact us | View Our Privacy and Policy

July 1, 2026

Your scope just grew. Your headcount didn’t.

Hi {{ .Subscriber.FirstName }},

You didn’t sign up for internal audit to become a cybersecurity engineer. Or a vendor contract specialist or an organizational psychologist.

But here you are.

The IIA’s new Global Internal Audit Standards just made cybersecurity, third-party risk, and organizational behavior mandatory audit territory. And the clock is already running.

The teams that figure this out fastest aren’t necessarily the ones with the biggest budgets or the most headcount. They’re the ones who don’t waste time reinventing the wheel. They walk into a new topical area with a clear framework, the right questions already mapped out, and a documentation approach that holds up when the audit committee starts asking follow-up questions.

I’m Mike Levy. I founded Cherry Hill Advisory, a risk advisory firm built for internal audit and risk leaders. The Risk Register is our weekly newsletter covering what’s actually moving in the profession. No filler, just the stuff worth knowing.

So we built the framework for you.

Practitioner’s Workbook: Cybersecurity Topical Requirement

Download Here

Practitioner’s Workbook:

Third-Party Risk

Topical Requirement

Download Here

Practitioner’s Workbook:

Organizational Behavior Topical Requirement

Download Here

Three free practitioner-level guides, one for each Topical Requirement, built for the auditor doing the actual work. Not a summary of the standard. Not a checklist that looks good and falls apart in the field. A practical, field-ready framework that gets your team from “we need to cover this” to “here’s how we cover it credibly” without burning three weeks figuring it out from scratch.

We also put together the AI Internal Audit Encyclopedia. If AI is already on your plate, it covers adoption, automation, risk assessment, and governance in one place.

AI Internal Audit Encyclopedia

Download Here

One of the things I care most about is making sure internal audit and risk professionals have access to real, practical education not just the people whose organizations can afford it. The workbooks above are free. Most of our monthly CPE webinars are free. Some sessions go deeper into specific topics and are paid but the door into this community is always open.

And if you want to go deeper, we cover this live. Every month we run free CPE webinars built around exactly these topics, the kind of sessions where you can ask the questions you can’t Google. Cyber risk in June. Third-party risk in July. More details are below.

Download the workbooks. Join us live if you can. And if this is the kind of thinking you want in your inbox every week, you’re in the right place.

Mike Levy

CIA, CRMA, CISSP, CISA, CDPSE, MBA

CEO & Managing Principal

Cherry Hill Advisory

Upcoming Webinars

In the past two years, we’ve presented to around 100,000 auditors.

Most of our monthly CPE webinars are free with a few paid deep-dive sessions into specific topics.

Third-Party Risk: The Places Where Vendors Usually Break Down

July 15 | 12-1 PM ET
1 NASBA CPE

Fieldwork Fridays: The Prompt

July 17 | 12-1 PM ET
1 NASBA CPE

Supply Chain and Geopolitical Strain: What IA Should Look For Now

August 18 | 12-1 PM ET

1 NASBA CPE

Cherry Hill Advisory is registered with the National Association of State Boards of Accountancy (NASBA) as a sponsor of continuing professional education on the National Registry of CPE Sponsors.