Third-Party and Vendor Management

Third-party and vendor management. The core of this lesson is one line: you can outsource the work, but not the accountability.

Here is the situation. An organisation moves payroll to a specialist provider, and the C-I-O tells you the risk now sits with the vendor. Six months later the vendor has a breach, and the regulator’s letter arrives on the C-I-O’s desk, not the vendor’s. Outsourcing moved the work. It did not move what the exam wants you to see.

The single most tested point in third-party management is timing. The controls you want must be in the contract before it is signed. Before go-live, the organisation has leverage, the provider wants the deal. After signing, that leverage is gone. So the contract, not a later review, is where you fix everything.

What goes in the contract, while you still have the leverage: the right to audit, or an agreed alternative form of assurance. Security requirements the provider must meet. Service levels and the consequences of missing them. Data handling. And exit terms. Let us place those.

First, the right to audit, or an agreed assurance report in its place. Sought only after a problem is suspected, it is a right you never secured.

Then the security requirements the provider must meet, and the service levels, with real consequences for missing them. A target with no consequence has no force.

And then data handling: where the data lives, how it is protected, how it is returned or destroyed on exit. And exit terms, so you are not trapped when the relationship ends. When a question asks when to establish the right to audit, the answer is in the contract, before signing.

Now, large providers, cloud platforms especially, will not grant every customer direct audit access, and the exam accepts this. The standard substitute is an independent assurance report, such as a SOC two Type two. You rely on it as third-party assurance over the provider’s controls.

But relying on it is not swallowing it. Check its scope, does it cover the controls that matter here. Check its period, a Type two covers a span of operation, not a single moment. And check the complementary controls it assumes you perform yourself. What you do not do is reject it just because it is not a direct audit, accept it without reading the scope, or treat it as a substitute for understanding your own controls.

The principle underneath all of it: accountability stays home. When a provider breaches data you are responsible for, you remain accountable, and in most regimes you remain the data controller, whoever did the processing. The contract may apportion liability, but the obligation to protect the data does not leave you.

Which is the trap. It is theirs now is always the wrong answer. Outsourcing transfers the activity and some financial liability. It does not transfer the accountability, or the obligation to protect the data.

So carry this away. Establish the right to audit, and everything else you need, in the contract, before signing. Once the contract is agreed, your leverage is gone, and the accountability was never the vendor’s to take.