Topics in this domain
- Risk Response Options: Accept, Mitigate, Transfer, Avoid
- Aligning Responses with Appetite and Tolerance
- Cost-Benefit Analysis of Risk Responses
- Bias in Risk Decisions and Reporting
- Risk Owners and Control Owners
- RACI and Escalation
- Third-Party Risk Governance and Due Diligence
- Contracts, SLAs and the Right to Audit
- Monitoring Third Parties and Planning Exit
- Managing Issues, Findings and Control Deviations
- Risk Acceptance, Exceptions and Exemptions
- Control Frameworks and Their Purpose
- Control Types and Functions
- Designing and Selecting Controls
- Implementing Controls and Why Implementations Fail
- Control Design versus Operating Effectiveness
- Control Testing: Objectives, Evidence and Frequency
- Building and Tracking Risk Action Plans
- Collecting and Aggregating Risk Data
- Validating Risk Data Quality
- KRIs, KPIs and KCIs
- Thresholds, Escalation Triggers and Appetite
- Metric Pitfalls and Misuse
- Continuous Monitoring versus Periodic Assessment
- Tailoring Risk Reports to the Audience
- Heat Maps, Dashboards and Scorecards
- Identifying and Assessing Emerging Risks
- Integrating Emerging Risk into Decisions
Monitoring Third Parties and Planning Exit
Ongoing monitoring
Warning signs
- Repeated SLA breaches.
- Late or qualified assurance reports.
- New subcontractors or data locations without notice.
- Financial distress or change of ownership.
- Security incidents, or poor communication about them.
Planning exit
Example. When a niche CRM provider announced it was closing, a firm with a tested exit plan moved to a new provider in eight weeks using contracted data exports. A competitor without one lost two months of customer history.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| How often to review a critical supplier | Regularly, in proportion to risk |
| BEST control for supplier failure risk | A tested exit plan and alternatives |
| When to plan exit | At the start of the relationship |
| At contract end | Revoke access; return or destroy data |
In short
- Third-party risk changes during the contract; monitor in proportion to the supplier's tier.
- Monitoring covers SLAs, assurance reports, incidents, changes, external ratings and relationship reviews.
- Exit strategies should be planned at the start and tested for critical suppliers.
- Exit plans cover triggers, alternatives, data return and deletion, and transition support.
- Concentration on a single critical supplier is a risk in itself.
Exam traps
- Assessing suppliers only once, before signing.
- No exit plan until the supplier fails.
- Forgetting to revoke supplier access and recover data at exit.
- Ignoring changes in a supplier's subcontractors or ownership.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Ongoing monitoring
Planning exit
ExampleWhen a niche CRM provider announced it was closing, a firm with a tested exit plan moved to a new provider in eight weeks using contracted data exports. A competitor without one lost two months of customer history.
1 / 7