3.10A Third Party Risks

3.10A Third Party Risks

Risk practitioners should evaluate and determine the risk related to outsourcing of business processes. He should ensure that ownership of the data and processes remains with the organization. Risk practitioners should ensure that third party service providers have appropriate controls to address the security requirements as well as regulatory requirements. Risk practitioners should also ensure that security requirements of the organization are addressed in the outsourcing contract to make the service provider bound to comply with specific security requirements. Service level agreement should include declaring the jurisdiction of the agreement and which courts would hear any dispute related to the terms and conditions of the contract.

Right to Audit Clause

Periodic audit is the most effective method to ensure that service provider is complying with the security requirements of the service receiver. Service level agreement should include clauses with respect to the right to audit the system and processes of the service provider. The service provider may not allow the service receiver to audit them directly. In such cases, there should be a provision to assess compliance by an independent auditor. If such provision is not included in the agreement, then the service receiver has no way to ensure compliance or proper handling of their data.

Sub - contracting / Fourth Party

Service level agreement should specifically restrict the sub - contracting to a fourth party. In case it is allowed considering the business requirement, risk practitioners should consider the risk of subcontracting. In the case of subcontracting service receivers generally do not have control of the fourth party. The subcontracting process has to be thoroughly reviewed when the process involves sharing critical data.

Impact of Privacy Laws on Outsourcing

Risk practitioners should also ensure that laws and regulations are adhered to while outsourcing a process. For example, privacy law may prevent storage of personal data at offshore locations.

Compliance Responsibility

Service receiver retains the responsibility for ensuring compliance with regulatory requirements. Service receiver is the deemed to be owner of the data and responsible for the safe custody of the data. If the service provider fails to safeguard the data, authority will generally hold the organization responsible for non-compliance and take appropriate action including penalties.

Key aspects from CRISC exam perspective

CRISC Question	Possible Answer
What is the most important consideration for a risk practitioner while reviewing a outsourcing control?	Whether security requirements are addressed in the contract
What is the most important consideration for storage of private data at an offshore location?	Privacy laws may prevent a cross-border flow of information.
Who will be responsible for regulatory non- compliance? Service receiver or service provider	Organization who outsources the work (i.e. service receiver)
Best method to protect the confidentiality of data being transmitted over a network	Encapsulating the data packets Encryption
Best security measure when a third party is engaged in application development	To conduct a security code review for the entire application to detect all the malware including back doors.

Flashcards - 3.10A Third Party Risks

Practice Questions - 3.10A Third Party Risks