A vendor audit programme template that works — governance, scope, methodology, control library, findings, remediation and reporting that hold up under scrutiny.