Topics in this domain
- Risk Response Options: Accept, Mitigate, Transfer, Avoid
- Aligning Responses with Appetite and Tolerance
- Cost-Benefit Analysis of Risk Responses
- Bias in Risk Decisions and Reporting
- Risk Owners and Control Owners
- RACI and Escalation
- Third-Party Risk Governance and Due Diligence
- Contracts, SLAs and the Right to Audit
- Monitoring Third Parties and Planning Exit
- Managing Issues, Findings and Control Deviations
- Risk Acceptance, Exceptions and Exemptions
- Control Frameworks and Their Purpose
- Control Types and Functions
- Designing and Selecting Controls
- Implementing Controls and Why Implementations Fail
- Control Design versus Operating Effectiveness
- Control Testing: Objectives, Evidence and Frequency
- Building and Tracking Risk Action Plans
- Collecting and Aggregating Risk Data
- Validating Risk Data Quality
- KRIs, KPIs and KCIs
- Thresholds, Escalation Triggers and Appetite
- Metric Pitfalls and Misuse
- Continuous Monitoring versus Periodic Assessment
- Tailoring Risk Reports to the Audience
- Heat Maps, Dashboards and Scorecards
- Identifying and Assessing Emerging Risks
- Integrating Emerging Risk into Decisions
Third-Party Risk Governance and Due Diligence
The third-party life cycle
Outsourcing transfers activities, not accountability.
Tiering suppliers
Due diligence
Due diligence happens before signing, while the organisation still has leverage to negotiate requirements.
Example. Due diligence on a payroll SaaS provider found its SOC 2 report covered only its US data centre, while the organisation’s data would sit in Europe. The contract was made conditional on a European assurance report.
Beyond the third party
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| When to assess a supplier’s security | Before signing the contract |
| BEST way to manage many suppliers | Tier them by risk and scale the effort |
| Who is accountable for outsourced data | The organisation |
| Supplier presents an ISO 27001 certificate | Check the scope covers the service |
In short
- Third-party risk management covers suppliers from planning through due diligence, contract, onboarding, monitoring and exit.
- Outsourcing transfers activities, not accountability.
- Tier suppliers by risk so that due diligence effort matches what they can affect.
- Due diligence happens before signing and covers security, finances, resilience, compliance and subcontractors.
- Fourth parties (suppliers' suppliers) are part of the risk.
Exam traps
- Assessing suppliers only after the contract is signed.
- Giving every supplier the same level of review.
- Relying on a certificate without checking its scope.
- Believing outsourcing moves accountability to the supplier.
Slides
Click the slide and use the arrow keys. F toggles full screen.
The third-party life cycle
Tiering suppliers
Due diligence
ExampleDue diligence on a payroll SaaS provider found its SOC 2 report covered only its US data centre, while the organisation's data would sit in Europe. The contract was made conditional on a European assurance report.
Beyond the third party
1 / 8