Third-Party & Vendor Risk

Risks

Security · operational · financial · compliance · reputational · concentration · fourth-party (subcontractors).

Life cycle

1. Plan and tier by criticality
2. Due diligence (questionnaires, System and Organization Controls (SOC) reports, financials)
3. Contract: service level agreements (SLAs), security, right to audit, breach notice, subcontractors, exit terms
4. Onboard with least privilege
5. Monitor (annual SOC review, SLA tracking)
6. Offboard: remove access, return or destroy data

Reviewing a SOC report

• Scope · period (bridge letter for gaps) · opinion · exceptions.
• Complementary user entity controls (CUECs) — customer must perform.
• Carve-out subservice organizations → get their assurance too.

Which report

SOC 1 → financial reporting. SOC 2 → security and other trust criteria. SOC 3 → screening only.

Exam traps

• Outsourcing a process doesn't outsource the risk — the user entity remains responsible.
• A bridge letter covers the gap after the SOC report period, but it is management's statement and isn't audited.
• Put the right to audit in the contract before signing — it's hard to add later.