Third-Party SaaS: Risk Acceptance or Termination?

The process must be risk-based, documented, and aligned with MAM's risk appetite. Steps:

1. Gather facts: Obtain the SOC 2 report, contract, subprocessor details, and the regulatory obligation text (SEC 17a-4). Quantify the potential impact of a 6-hour outage on trade settlement and record preservation.
2. Assess materiality: Determine whether the qualified opinion and undisclosed subprocessor constitute a material risk. Criteria: likelihood of recurrence, impact on regulatory compliance, financial loss, reputational harm.
3. Identify compensating controls: For example, daily encrypted data extraction to MAM's on-prem archive, contractual service credits, vendor commitment to notify subprocessor changes, and a documented exit plan.
4. Consult stakeholders: CISO, COO, compliance, legal, and procurement. Document their positions and any disagreements.
5. Prepare risk register entry: Score the inherent risk and residual risk after compensating controls using MAM's risk matrix. Cite the risk appetite statement.
6. Present to risk committee: Provide a recommendation with options (accept, terminate, escalate for formal risk acceptance). Include a draft risk acceptance memo if recommending acceptance.
7. Document decision: Record the committee's decision, rationale, and monitoring plan in the governance repository.

Key artifacts: risk assessment report, gap analysis, compensating control plan, board memo, decision log. Decision criteria: risk appetite alignment, regulatory defensibility, operational continuity, and cost.

Option (c) escalation is most defensible. Reasoning:

• Option (a) accept with compensating controls: Compensating controls (e.g., daily data extraction, contractual remedies) can reduce residual risk, but the risk appetite explicitly prohibits risks that could cause regulatory sanction. Because SEC 17a-4 record preservation could be impaired, the residual risk may still exceed appetite. Accepting without board awareness would violate governance expectations.
• Option (b) terminate and migrate: Migration would take 9 months and disrupt 1,200 client reports, creating operational and reputational risk. It does not address the immediate risk and may introduce new risks. Termination is disproportionate without a transitional plan.
• Option (c) escalate to the board: The board risk committee is the appropriate body to accept risks that approach or exceed appetite. The GRC lead should present a recommendation to accept the risk temporarily, contingent on specific compensating controls and a 12-month exit plan. This preserves operational continuity while ensuring informed risk acceptance and regulatory defensibility.

Thus, escalation with a conditional recommendation is the most defensible because it respects risk appetite, documents the decision at the right level, and mitigates immediate exposure.

Risk Acceptance Memo: PortCloud SaaS

• Background: PortCloud supports trade settlement and client reporting for 1,200 clients. SOC 2 Type II qualified on availability (6-hour outage). Undisclosed subprocessor change.
• Risk description: Potential outage could impair MAM's ability to preserve records under SEC Rule 17a-4, leading to regulatory sanction and reputational harm. Likelihood: medium (past outage, subprocessor opacity). Impact: high (regulatory, operational).
• Compensating controls: (1) Daily encrypted extraction of all transaction and client records to MAM's on-prem archive, with restoration tested monthly. (2) Contract amendment requiring 30-day notice of subprocessor changes and audit rights. (3) Service credits for outages exceeding 2 hours. (4) Documented 12-month exit plan with data migration rehearsals.
• Residual risk: Reduced from high to medium-low, but not eliminated. Residual risk remains above appetite for regulatory sanction if controls fail.
• Monitoring plan: Monthly review of SOC 2 updates and subprocessor notifications; quarterly vendor risk assessment; incident notification within 1 hour; annual test of exit plan. Report to risk committee quarterly.
• Recommendation: Approve temporary risk acceptance for 12 months, contingent on the above controls and a quarterly review. If controls fail, initiate termination.