· By Nicholas “Nick” O'Sullivan, Townsville
What a Queensland Audit Office report on third-party cyber risk means for the rest of us
The Queensland Audit Office has published Report 13: 2025–26, Managing third-party cyber security risks, examining how three public sector entities — one state government department, one statutory body and one local government — manage the cyber risk that comes with using IT vendors, accounting firms, marketing businesses and consultants. QAO chose not to name the audited entities, but the findings are specific enough to be genuinely useful well beyond the public sector.
The headline finding is uncomfortable: testing found that in at least two of the three entities, auditors were able to reach administrator-level access to critical systems, including finance and payroll platforms, by exploiting weaknesses in how third-party access was configured. More broadly, auditors reported being able to obtain passwords, access systems, and extract sensitive information well outside the scope a third-party user should ever have had.
The procurement findings were just as telling. Auditors reviewed 36 contracts — 12 from each entity, selected for elevated third-party cyber security risk. Only 2 of the 36 contracts required the vendor to report cyber security incidents or vulnerabilities back to the entity. None of the 36 addressed security requirements for the vendor’s own suppliers — the “fourth parties” a contractor might depend on to actually deliver the service.
Risk assessment was similarly thin. Entities generally hadn’t comprehensively mapped their own supply chains or identified which third parties carried the most risk. Only two of the three entities had documented any third-party risks at all, and only one had gone as far as assessing the impact and likelihood of those risks — the basic first step of any risk register.
For scale, the report notes the Australian Signals Directorate responded to 107 supply-chain-related cyber security incidents in 2023–24 — around 10% of all the incidents it handled that year. This isn’t a hypothetical category of risk; it’s already a meaningful share of what the national cyber security agency deals with.
QAO made seven recommendations. Five apply to all public sector entities and local governments: strengthen identity and access management so third parties hold only the minimum access they need; improve monitoring and alerting so suspicious third-party activity is actually detected; update IT policies to properly define how third-party risk is identified and assessed; formally identify supply chains and assess the impact and likelihood of the risks within them; and strengthen procurement and contract management, including requiring incident reporting and building staff skills to manage vendor risk. The remaining two recommendations were directed at the Department of Customer Services, Open Data and Small and Family Business, and the Department of Housing and Public Works, both of which lead cyber capability across the Queensland public sector — asking them to better track how their guidance is actually being adopted rather than simply publishing it.
Our reflection, for the businesses, charities and schools we work with: it would be easy to read this as a public-sector story and move on. We don’t think that’s the right takeaway. The failure patterns in this report — vendor access left broader than necessary, no register of who actually holds risk on your behalf, contracts silent on security, and zero visibility of what your vendor’s own vendors can reach — are exactly what we tend to find in small and mid-sized organisations too. The difference is that a government department at least has an IS18 assessment cycle and an Auditor-General checking in. Most small businesses, charities and schools have neither, which means these gaps can sit unnoticed for years rather than surfacing in a report.
A few questions worth asking about your own vendors, prompted directly by this report: Does your web developer, bookkeeper, MSP or software vendor have more access to your systems and data than their actual job requires? If that vendor were compromised, would you find out from them, or would you find out from a customer, a bank, or the news? Does your contract with them say anything at all about security — incident notification, data handling, access removal on termination — or does it simply cover price and deliverables? And do you have any visibility into who they rely on to deliver your service?
None of this requires a government-scale audit function to start fixing. A practical first step is a straightforward review: list the vendors with meaningful access to your systems or data, check what access they actually have versus what they need, and see what — if anything — your existing contracts say about security. That review is exactly what Suburban Secure’s Leadership Technology Review covers for businesses, charities and schools who want an independent look at this before it becomes a finding in someone else’s report.
