The Vendor That Scored Green
A wealth-management platform outsources its client onboarding and KYC checks to a vendor. The vendor's annual risk assessment scores it 'low risk' on a 1-5 matrix because it has ISO 27001 certification and a 99.95% uptime record. The contract has no right-to-audit clause and no defined exit assistance. The vendor subcontracted the document-verification step to a fourth party in another jurisdiction 8 months ago; the platform learned of this from a news article. Regulators require the firm to manage outsourcing risk proportionately to the criticality of the function. Onboarding failure would stop new client acquisition entirely. The head of procurement says the score is defensible because 'the certification is current.'
1. Critique the risk assessment methodology. What dimensions is it missing, and what should the score be?
Read the worked answer
The score is built on two proxies - a certification and an uptime figure - neither of which measures the risk that matters here.
Missing dimensions:
- Criticality / substitutability. Onboarding is a critical function with no workaround; failure halts revenue. That alone should push the inherent rating up regardless of vendor quality.
- Concentration and fourth-party risk. A subcontracted verification step in another jurisdiction introduces regulatory, data-transfer, and oversight risk the firm did not assess and was not told about.
- Contractual control. No right to audit and no exit assistance means the firm cannot verify or leave. Control weakness is a risk dimension, not a footnote.
- Data sensitivity. KYC data is high-sensitivity personal data; a generic 'low risk' ignores it.
The ISO 27001 certificate is evidence of a control framework at a point in time; it says nothing about subcontracting, exit, or jurisdictional exposure. Uptime measures availability, not integrity or compliance.
Revised score: inherent risk high (critical function, sensitive data, no substitute); control effectiveness reduced by absent audit rights and undisclosed subcontracting. Residual should be high, not low. Procurement's 'certification is current' defence answers a question nobody asked.
2. The firm cannot exit immediately. Set out the actions it should take in the next 90 days and the contractual positions it must secure.
Read the worked answer
Next 90 days:
- Re-rate and re-approve. Re-score the vendor as high residual risk, document the rationale, and route to the appropriate risk committee for formal acceptance of the residual - not silent continuation.
- Fourth-party discovery. Require a full sub-processor list with locations, data flows, and the fourth party's own assurance. Assess the cross-border data transfer against regulatory requirements before anything else.
- Interim monitoring. Increase review frequency, add onboarding-failure and verification-error metrics, and require notification of any further subcontracting.
Contractual positions to secure (in priority order):
- Right to audit (or accepted equivalent: right to independent assessment reports and on-site access on notice).
- Subcontracting control: prior written consent, flow-down of obligations, and notification.
- Exit assistance: defined transition period, data return/deletion, and cooperation obligations - without this, the 'cannot exit' problem becomes permanent.
- Service levels tied to the critical function, with remedies.
Board message: the vendor is not low risk; it is a critical, hard-to-replace provider with weak contractual control and an undisclosed fourth party. The firm is accepting that residual for a defined period while it builds exit optionality, and the board should see that acceptance explicitly rather than inherit it by default.