Evaluation Details Flashcards

Which evaluation methodology best supports continuous monitoring of a third party's control environment between annual assessments?

Answer: Automated control testing and real-time risk indicator feeds

Automated control testing and real-time risk indicators enable continuous visibility without the cost of repeated full audits.

A vendor's SOC 2 Type II report covers a 6-month period ending 9 months ago. What is the primary concern for a risk evaluator?

Answer: The report is stale and may not reflect current controls

A report that is 9 months old may not capture control changes made since the coverage period, creating a gap in assurance.

During an on-site evaluation, an assessor discovers that access control logs exist but are never reviewed. Which risk domain does this finding primarily affect?

Answer: Information security risk

Unreviewed access logs represent a detective control gap within the information security domain, leaving unauthorized access undetected.

When evaluating a fourth-party (subcontractor of a vendor), the MOST appropriate first step is to:

Answer: Review the vendor's own third-party risk program and subcontractor inventory

Reviewing the vendor's own TPRM program and subcontractor inventory establishes concentration risk visibility before deciding if direct engagement is warranted.

A risk tiering model classifies vendors as Critical, High, Medium, or Low. Which factor most directly elevates a vendor from Medium to High tier?

Answer: The vendor has access to regulated customer data at scale

Access to regulated customer data at scale significantly increases the potential impact of a vendor incident, driving a higher risk tier.

An evaluator receives a completed security questionnaire but cannot verify any of the vendor's responses. The BEST next step is to:

Answer: Request supporting evidence such as audit reports, screenshots, or policies

Requesting supporting evidence allows the evaluator to validate self-reported controls and ensure the questionnaire reflects actual practice.

Which evaluation output is MOST useful for communicating third-party risk posture to senior management?

Answer: A risk-rated heat map with aggregated vendor scores and trend data

A heat map with aggregated scores and trends translates technical findings into executive-level insight for decision-making.