The Vendor Who Hosts the Core
A bank with $5 billion in assets outsources its core processing to a vendor that hosts the system in a third-party data center. The vendor's most recent SOC 2 Type II report covers a 12-month period ending 14 months ago and includes a qualified opinion on one control: logical access reviews were not performed for two quarters. The vendor's contract requires annual SOC reports and notification of material changes within 30 days. The bank's IT auditor learns from a conference that the vendor migrated to a new cloud provider eight months ago and that the migration was not disclosed. The bank's own access review process depends on a vendor-provided user list that is now generated by the new cloud environment. No incident has occurred.
1. What are the control and contract issues, and how should the auditor assess the risk?
Read the worked answer
There are three overlapping issues. First, contract compliance: the vendor breached the 30-day material-change notification requirement by not disclosing the cloud migration. Second, assurance gap: the SOC 2 report is stale (14 months old) and already carried a qualified opinion on logical access reviews, which is precisely the control area affected by the migration. Third, dependency risk: the bank's own access review relies on a vendor-generated user list whose source environment changed, so the bank's control may be operating on unvalidated data.
Risk assessment should weigh: the criticality of core processing (high - outage or data integrity failure would halt operations), the concentration in a single vendor and now a single cloud provider, the absence of current assurance, and the fact that no incident has occurred (which reduces urgency but not exposure). The auditor should rate this as a significant issue and consider whether the bank's third-party risk management policy requires an exception report to the board. The auditor should also determine whether the bank has a right to audit and whether it has ever exercised it.
2. Design the audit response and the questions you would put to vendor management.
Read the worked answer
The response has four parts. (1) Obtain current assurance: request the SOC 2 report covering the period after migration, a bridge letter covering the gap, and the cloud provider's own SOC 2 report; if unavailable, invoke the right-to-audit or require a completed security questionnaire with evidence. (2) Validate the user list: independently reconcile the vendor-provided access list to the bank's HR records and to the bank's own identity system, and confirm that terminated employees and role changes are reflected. (3) Test the migration: ask for the migration plan, data-integrity testing, encryption configuration, and incident history during cutover. (4) Escalate: document the contract breach and require a remediation plan with dates.
Questions for vendor management: When did you learn of the migration, and from whom? Did you receive any notice? What does the contract say about subcontracting and data location? Has the bank's data-residency or regulatory notification obligation been assessed? Who at the bank owns the vendor relationship, and when was the last due diligence review? What is the exit strategy if the vendor fails? The auditor should record answers and follow up on any that are evasive.