Topics in this domain
- Risk Response Options: Accept, Mitigate, Transfer, Avoid
- Aligning Responses with Appetite and Tolerance
- Cost-Benefit Analysis of Risk Responses
- Bias in Risk Decisions and Reporting
- Risk Owners and Control Owners
- RACI and Escalation
- Third-Party Risk Governance and Due Diligence
- Contracts, SLAs and the Right to Audit
- Monitoring Third Parties and Planning Exit
- Managing Issues, Findings and Control Deviations
- Risk Acceptance, Exceptions and Exemptions
- Control Frameworks and Their Purpose
- Control Types and Functions
- Designing and Selecting Controls
- Implementing Controls and Why Implementations Fail
- Control Design versus Operating Effectiveness
- Control Testing: Objectives, Evidence and Frequency
- Building and Tracking Risk Action Plans
- Collecting and Aggregating Risk Data
- Validating Risk Data Quality
- KRIs, KPIs and KCIs
- Thresholds, Escalation Triggers and Appetite
- Metric Pitfalls and Misuse
- Continuous Monitoring versus Periodic Assessment
- Tailoring Risk Reports to the Audience
- Heat Maps, Dashboards and Scorecards
- Identifying and Assessing Emerging Risks
- Integrating Emerging Risk into Decisions
Contracts, SLAs and the Right to Audit
Clauses that matter
If a requirement isn’t in the contract, it usually can’t be enforced later. The practitioner defines the requirements; legal makes them binding.
Good and bad SLAs
| Weak | Strong |
|---|---|
| High availability | 99.9% monthly, measured end to end |
| Prompt incident response | Severity 1 response within 30 minutes |
| Timely breach notice | Notify within 24 hours of discovery |
Right to audit
Without a right to audit, or at least to receive independent assurance reports such as SOC 2 Type II, the organisation can’t verify that the supplier’s controls work. Large providers often offer reports instead of on-site audits; check that their scope covers the services used.
Example. After a supplier breach, a retailer found its contract had no breach notification clause. The supplier told customers three weeks later. New contracts now require notice within 24 hours and cooperation with investigations.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| MOST important clause for oversight | Right to audit or to receive assurance reports |
| Characteristic of a good SLA | Specific, measurable, monitored |
| When to define security requirements | Before the contract is signed |
| Provider refuses on-site audits | Accept independent assurance reports of relevant scope |
In short
- If a requirement isn't in the contract, it usually can't be enforced later.
- Key clauses cover security requirements, right to audit, breach notification, data handling, SLAs, liability and exit.
- A right to audit, or to receive independent assurance reports, is essential for ongoing oversight.
- SLAs must be specific and measurable, with consequences for breaches.
- The risk practitioner defines requirements; legal makes them binding.
Exam traps
- Vague SLAs such as 'high availability'.
- Signing standard supplier terms with no right to audit.
- Missing breach notification timelines.
- No clause on returning or deleting data at exit.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Clauses that matter
1 / 7