As healthcare organizations continue to expand both in size and complexity, reliance on third-party business partners across patient and non-patient facing functions has grown, thus increasing both the types (clinical, financial, operational, reputational) and levels of risks to the organization.  The increasing risk and reliance on third-party partners have caused organizations to develop third-party risk management (TPRM) programs or other types of vendor management-related functions to evaluate and mitigate the risks introduced over the course of the relationship. However, with ever-increasing costs and reliance on third-party products and services, across a multitude of complex contractual agreements, addendums, and service level agreements (SLAs), these programs often do not have the necessary resources and processes aligned to effectively manage and monitor the applicable third-party risks.  In this session we will review how Internal Audit can support the organization with understanding, preparing for, and responding to the challenges and risks associated with third-party risk management.  We will discuss potential internal audit approaches to assess TPRM program governance and structure, policies and procedures, risk mitigation frameworks, and tools and techniques in place across the third-party relationship lifecycle.  To facilitate understanding of the concepts, we will present a deep-dive case study of a TPRM internal audit focused on a critical vendor providing Electronic Health Records technology and managed services.