Third-Party & Vendor Risk

Why this topic matters

Organizations outsource payroll, hosting, software, payment processing, and more — but they cannot outsource accountability for the risks. Information Systems and Controls (ISC) Area III (considerations for System and Organization Controls (SOC) engagements, 15–25%) tests how organizations manage third-party risk across the vendor life cycle and how they use SOC reports as part of that monitoring.

Types of third-party risk

Risk	Example
Security and privacy	A vendor with access to customer data suffers a breach
Operational and availability	A cloud provider outage halts order processing
Financial	A critical supplier becomes insolvent
Compliance and legal	A processor mishandles data covered by privacy laws; the company is still liable
Reputational	A supplier's labor or ethics scandal
Concentration	Many critical services depend on one provider
Fourth-party (nth-party)	Your vendor's own subcontractors (subservice organizations) introduce risk you don't see directly

The third-party risk management life cycle

1. Planning and risk assessment — define the need; tier vendors by criticality and the sensitivity of data or access involved, so effort matches risk.
2. Due diligence — before signing: security questionnaires, SOC reports, certifications (for example, International Organization for Standardization (ISO) 27001), financial stability, references, insurance, business continuity capability, and use of subcontractors.
3. Contracting — include:
   • Scope, performance standards, and service level agreements (SLAs) with remedies;
   • Security and privacy requirements, data ownership, and data location;
   • Right-to-audit clauses and obligations to provide SOC reports;
   • Breach notification timelines;
   • Subcontractor approval and flow-down requirements;
   • Business continuity obligations;
   • Termination rights and exit provisions (return or destruction of data, transition assistance).
4. Onboarding — grant least-privilege access, set up monitoring, record the vendor in an inventory.
5. Ongoing monitoring — review SOC reports annually, track SLA performance and incidents, reassess risk when services change, monitor news and financial health.
6. Termination (offboarding) — remove all access promptly, retrieve or certify destruction of data, transition services.

Using SOC reports in vendor monitoring

Report	Use
SOC 1 Type 2	Vendor processes that affect the customer's financial reporting (payroll, claims processing) — relied on by the customer's management and auditors
SOC 2 Type 2	Security, availability, processing integrity, confidentiality, and privacy of the vendor's system (cloud hosting, software as a service)
SOC 3	A general-use summary — useful for initial screening, not detailed reliance

When reviewing a SOC report, the customer should check:

• Scope — the right services, locations, and systems are covered.
• Period — it covers enough of the customer's fiscal year; for a gap, obtain a bridge (gap) letter from the vendor's management and consider other procedures.
• Opinion — unmodified, or qualified (and why).
• Exceptions noted in testing and management's responses — assess the effect on the customer.
• Complementary user entity controls (CUECs) — controls the vendor expects the customer to operate (for example, reviewing reports, managing its own user access). The customer must implement and test these.
• Subservice organizations — whether the carve-out or inclusive method was used; for carve-outs, obtain those providers' SOC reports or other assurance, and review complementary subservice organization controls.

Other assurance options

• Vendor questionnaires (standardized versions exist), on-site or virtual assessments, and penetration test summaries.
• Continuous monitoring services that rate vendors' external security posture.
• Certifications (ISO 27001, the Payment Card Industry Data Security Standard (PCI DSS)) — useful but narrower than a SOC 2 report.

Governance

• Board and senior management oversight, with a third-party risk policy and clear ownership (usually the business relationship owner, supported by procurement, security, legal, and compliance).
• A complete vendor inventory with risk tiers.
• For banks, federal regulators' interagency guidance on third-party relationships (2023) sets expectations across the life cycle.

How it is tested

• Order and describe the vendor life cycle stages.
• Identify contract provisions that manage vendor risk.
• Evaluate a SOC report for scope, period gaps, exceptions, and CUECs.
• Recognize fourth-party and concentration risk.