Scoring a Vendor Nobody Can Rate
A health-insurance administrator is onboarding a cloud vendor that will process member claims data. The vendor risk team uses a questionnaire scored 1-5 across 40 controls. The vendor returned the questionnaire but answered 12 questions 'N/A' and self-scored the rest, mostly 4s and 5s. The vendor refuses a site visit, citing a shared-responsibility model, and offers its SOC 2 Type II report instead. The report covers a period ending 11 months ago and has one qualified opinion on logical access. The business sponsor is pushing to sign within two weeks because a downstream client deadline looms. The vendor will hold protected health information.
1. How should the vendor risk team treat the questionnaire score and the SOC 2 report?
Read the worked answer
Neither artifact should be accepted at face value.
Questionnaire: a self-scored questionnaire where 12 items are 'N/A' and the rest are near-perfect is low-assurance evidence. The 'N/A' answers must be challenged - for a claims-data processor, controls like access management and encryption are rarely genuinely N/A. Each 'N/A' should be reclassified as 'not demonstrated' until explained.
SOC 2 Type II: it is valuable third-party evidence, but two problems reduce reliance: (1) the period ended 11 months ago, so it says little about current control operation - request a bridge letter or the most recent report; (2) the qualified opinion on logical access is directly material for PHI, because access control is the primary safeguard protecting member data. A qualified opinion means the auditor could not conclude the control operated effectively - that is a red flag, not a checkbox.
The team should treat the combination as insufficient assurance and map the gaps to the specific risk (PHI confidentiality and integrity), not average them into a single comfortable score.
2. The sponsor wants to sign in two weeks. What is a defensible path forward?
Read the worked answer
A defensible path separates 'sign' from 'accept unmanaged risk.'
- Don't let the deadline drive the risk decision. Escalate the decision to the accountable risk owner with the evidence gaps stated plainly: stale SOC 2, qualified access opinion, unverified questionnaire items.
- Targeted diligence on the material gap. Logical access is the issue - request the vendor's access-control documentation, recent access-review evidence, and remediation status for the qualified opinion. This can often be done in days.
- Contractual controls as compensating measures. Require security addenda: breach notification timelines, right to audit, access-control commitments, and a remediation plan with milestones for the qualified finding.
- Conditional approval with monitoring. If the business must proceed, approve with explicit conditions (remediation evidence within 60-90 days, updated SOC 2 upon issuance) and a named owner tracking them.
- Document the residual risk acceptance at the right level.
Signing with conditions is legitimate; signing while pretending the evidence is adequate is not. The record must show the gap was known, owned, and monitored.