Risk Response and Reporting · Topic 2 of 9
Vendor and Supply Chain Risk Management
CRISC third-party risk: vendor tiering, due diligence, contract clauses, SOC 2 reports, ongoing monitoring, fourth parties, concentration and exit plans.
- 5 min
- Outsourcing transfers work, not accountability.
- Tier vendors by service criticality and data sensitivity.
- SOC 2 Type II tests operating effectiveness over a period; always check scope.
What it is
Vendor or third-party risk is the risk that a supplier, service provider or partner causes harm through failure, breach, poor performance or non-compliance. Supply chain risk extends this to the supplier's own suppliers and to the components, software and services that flow into the organization's products.
Outsourcing moves work, not accountability. The organization remains responsible to its customers and regulators for what its vendors do on its behalf.
How it works
Tiering vendors
Not every vendor deserves the same effort. Vendors are tiered by the criticality of the service and the sensitivity of the data or access involved.
| Tier | Example | Level of oversight |
|---|---|---|
| Critical | Core banking SaaS, payment processor, cloud hosting | Full due diligence, strong contract, frequent monitoring, exit plan |
| Medium | HR system holding staff data | Standard questionnaire, assurance reports, annual review |
| Low | Office supplies, catering | Basic checks |
Due diligence
Before signing, the organization checks the vendor's financial stability, security and privacy controls, resilience, regulatory standing, reputation and its own reliance on subcontractors. Evidence includes questionnaires, independent assurance reports, certifications, on-site or remote assessments and references.
Assurance reports
| Report | Covers | Note |
|---|---|---|
| SOC 1 | Controls relevant to customers' financial reporting | Used by financial auditors |
| SOC 2 | Controls over security, availability, processing integrity, confidentiality and privacy | Type I tests design at a point in time; Type II tests operating effectiveness over a period |
| ISO/IEC 27001 certificate | That an ISMS meets the standard for a defined scope | Check the scope and statement of applicability |
Always check the scope and period. A report that covers a different service or data centre gives little assurance. Read the exceptions and the complementary user entity controls the customer must operate.
Contract clauses
| Clause | Purpose |
|---|---|
| Service levels | Measurable targets and penalties |
| Security and privacy requirements | Controls the vendor must maintain |
| Right to audit | Lets the organization or regulator inspect controls |
| Incident notification | Time limits for reporting breaches and outages |
| Subcontracting | Approval and flow-down of obligations to subcontractors |
| Data location, return and destruction | Where data lives and what happens at exit |
| Business continuity | Vendor's recovery capability and testing |
| Termination and exit support | Orderly transfer to another provider |
It is far easier to negotiate these before signing than after.
Ongoing monitoring
Monitoring includes SLA reports, KRIs such as missed SLAs or late incident reports, annual reassessment for critical vendors, review of updated assurance reports, financial health checks and news monitoring. A change in the vendor's ownership, location or subcontractors should trigger reassessment.
Supply chain and concentration
Fourth parties are the vendor's own suppliers. A SaaS provider may host on a major cloud platform, so an outage there affects the organization indirectly. Concentration risk arises when many critical services depend on the same provider.
Software supply chain risk includes compromised updates and vulnerable open source components. A software bill of materials (SBOM) lists components so the organization can see whether it is exposed when a new vulnerability is announced.
Exit planning
For critical vendors, an exit plan describes how to move to another provider or bring the service in-house if the vendor fails or the relationship ends. Without one, the organization can be locked in.
A worked example
A retailer plans to move customer service to a SaaS platform. The vendor is tiered critical because it will hold customer personal data. Due diligence finds a SOC 2 Type II report, but its scope excludes the new region where the retailer's data would be hosted.
The practitioner recommends that the risk owner require either a scoped assurance report or a contractual right to audit, plus a 24-hour breach notification clause and an exit plan. Until assurance for the new region is received, the risk is recorded as above appetite and escalated.
How the exam asks about this
- "What is the MOST important factor when selecting a cloud service provider?" That its controls meet the organization's security, compliance and resilience requirements for the data involved.
- "Which provides the BEST assurance over a vendor's controls operating over time?" A SOC 2 Type II report covering the relevant services and period.
- "Who remains accountable for customer data processed by a vendor?" The organization that outsourced the processing.
What to remember for the exam
- Outsourcing transfers work, not accountability.
- Tier vendors by service criticality and data sensitivity.
- SOC 2 Type II tests operating effectiveness over a period; always check scope.
- Key clauses: right to audit, incident notification, subcontracting, data return, exit support.
- Watch fourth parties and concentration on a single provider.
The best time to manage vendor risk is before the contract is signed. When an option offers to add security requirements during due diligence or contract negotiation, it is usually better than fixing problems later.
Common mistakes
Accepting a certificate without reading its scope. It may not cover the service or location used.
Monitoring only at onboarding. Vendors change ownership, locations and controls over time.
Forgetting complementary user entity controls. The vendor's controls assume the customer does its part.
Check yourself
What is the difference between a SOC 2 Type I and Type II report?
Type I tests whether controls are suitably designed at a point in time; Type II tests whether they operated effectively over a period.
Why does the organization need an exit plan for a critical vendor?
To move the service elsewhere in an orderly way if the vendor fails or the relationship ends, and to avoid lock-in.
What is a fourth party?
A supplier to the organization's vendor, whose failure can affect the organization indirectly.
Topic 2 of 9 in Risk Response and Reporting
Test yourself on Risk Response and Reporting
The full ISACA CRISC question bank has 1,000 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.