The gap between value and execution is the one I recognise most from the floor. Almost everyone can show you a supplier approval procedure and a risk register, but far fewer can show what actually changed after the last supplier problem, and that space between documented intent and lived practice is where most of my findings sit. Godly's point about evidence is spot on, when supplier and technology controls are thin the organisation usually cannot reconstruct why a decision was made, so you end up auditing memory rather than records.
On suppliers topping the list, part of it is that supplier risk is the one area where a company leans on a system it does not fully control, so the maturity of the monitoring rarely keeps pace with the reliance. The teams that handle it well are not the ones with the thickest procedures, they are the ones treating supplier performance as live operational data that feeds management review, rather than an annual tick.
------------------------------
Dilawar Laghari
Auditor, Consultant and Trainer
AuditWorkshop.com
------------------------------