Vendor Attestation Gap and Shadow SaaS at Northwind Distribution

Gaps exposed

1. No third-party risk process. A revenue-critical vendor was never assessed; a marketing tool was never assessed at all. There is no intake, no tiering by data sensitivity, no contract/DPA gate.
2. Procurement is outside IT's visibility. Business-led buying with a corporate card means spend and data flows are discovered after the fact - a governance authority problem, not a technology problem.
3. The risk register does not reflect reality. Twelve entries, zero vendor risk, in an environment where a vendor handles every order. Resource allocation follows the register, so the register's omission is the risk.
4. The risk appetite statement is decorative. 'Low tolerance for customer data loss' has not been converted into an operating rule (e.g., 'no customer data leaves the boundary without a DPA and a security review'). A statement with no escalation path is not a control.

Ranking logic. Rank on residual risk - likelihood x impact x detectability - not on how alarming each item sounds.

• Shadow email platform: highest. Data has already crossed the boundary, 40,000 records, unknown retention, no contractual ability to demand deletion or notification, and zero monitoring. Nobody would know if it were breached today. Unknown-unknown beats known-bad.
• RouteOpt: second, but close. Higher inherent impact (order flow, pricing) and it is in scope of a report you can read; the exceptions are known. It ranks below only because it is visible and therefore manageable.
• Risk register and appetite gap: third as a standalone item, first as a root cause. It is what allowed the other two.

Caveat that would flip the ordering: if RouteOpt touches billing or payment data, its ranking moves to first immediately - a change-management failure in a system that computes customer invoices is a financial reporting risk, not just an availability risk. Establish that fact before the meeting rather than after.

The CFO's premise is wrong: a qualified opinion means the service auditor could not conclude the controls were suitably designed or operating effectively. 'In substance' is not a category in the standards, and the lender's auditors will read the opinion, not the summary.

Evaluation steps

1. Scope first. Does the report actually cover the system Northwind relies on? A SOC 2 covering 'the RouteOpt platform' may exclude the optimisation engine that assigns routes. If the system description does not include what you depend on, the report is not evidence for anything.
2. Read the qualification precisely. Which control failed, over what sub-period, and what was the nature of the exception? Two of four quarters means reliance is broken for half the coverage period - you need a bridge letter and the vendor's remediation evidence for the gap.
3. The carve-out is the bigger issue. The hosting subservice organization is excluded from the opinion. Northwind therefore has no assurance over the physical and environmental, network, or infrastructure-layer controls supporting its order data. Obtain the subservice organization's own report (SOC 2 or SOC 3) or the vendor's own evidence, and map the complementary subservice organization controls the vendor is relying on you to know about.
4. Map complementary user entity controls (CUECs). If the report says customers must review access quarterly or reconcile output daily, and Northwind does neither, the effective control set does not exist regardless of what the vendor does.
5. Decide what compensating controls Northwind can operate itself - e.g., independent reconciliation of route assignments to orders, monitoring of pricing changes, contractual right to audit and notification.

What I would require before accepting the risk

• Written vendor remediation plan with dates for the failed change-management controls.
• The hosting subservice report, or a contractual commitment to provide it annually.
• Evidence that CUECs are assigned to a named Northwind owner.
• A documented risk acceptance signed at the right level - and if route integrity affects billed freight, that signature belongs with the CFO, not the CIO.

If the vendor will not provide 1–3, the correct conclusion is to plan a transition or build compensating detective controls on Northwind's side, and to say so plainly in the acceptance memo.

The paper should be short, factual, and structured around decisions rather than status.

1. What changed in the risk profile since the last report A revenue-critical vendor's independent assurance is qualified over half the coverage period and excludes the hosting layer. Customer data is confirmed to be outside the company's control environment via an unapproved tool. Neither fact was previously visible to the committee - which is itself the headline.

2. What we do not know, stated as such The inventory of SaaS holding company or customer data is incomplete. I would not present 'no known incidents' as assurance, because the absence of evidence here comes from the absence of monitoring, not from safety. Say that explicitly; it is the sentence a committee remembers.

3. The appetite conflict Frame it as a decision the committee owns: the approved appetite says low tolerance for customer data loss, while the operating reality permits unapproved tools to receive customer records. Either the appetite is revised or the control environment is changed. Presenting both options is what makes this governance rather than an IT complaint.

4. Decisions requested

• Approve a vendor risk policy with a hard gate: no customer data to a third party without a DPA and security review, with the CFO's delegated authority to enforce it against business units.
• Fund discovery - a CASB or SaaS management capability - with a reporting date.
• Direct a complete SaaS inventory and a data-mapping exercise by a named date, reported to the committee.
• Approve the RouteOpt risk acceptance at CFO level, or direct a contingency plan.

5. Specific asks for the email platform Confirm what fields were synced (contact details alone versus anything else), whether a DPA exists, whether deletion on request is contractually available, and whether the vendor has any independent attestation. Bring answers, not intentions.

Tone: the committee should leave knowing the risk, the owner, the date, and the decision - not a narrative of discovery.