The Outsourced IT Risk Rating
Cedarline Group, a $600 million distribution company, has an audit plan built from last year's risk register, which rates IT risk as 'low' because IT operations were outsourced to a single vendor in 2022. Since then: two ransomware attempts were blocked, the vendor has not provided a SOC 1 report for two years, the disaster-recovery plan has not been tested since 2022, and a new warehouse system went live in March with no post-implementation review. The audit committee has approved 2,000 hours for the year; the existing plan allocates 120 hours to IT. Management says the vendor contract includes a 'right to audit' clause, so 'IT is covered.' The CAE must present a revised plan at the next meeting.
1. Evaluate the 'low' IT risk rating. What evidence in the setup contradicts it, and how should the CAE reassess?
Read the worked answer
Risk ratings must reflect residual risk - likelihood and impact after controls - not the fact that a function was outsourced. Outsourcing transfers operations, not accountability.
Contradicting evidence:
- Two attempted ransomware events: realized attempts raise likelihood, not just theory.
- No SOC 1 report for two years: the organization has no independent evidence that the vendor's controls operate.
- DR untested since 2022: recoverability is unverified, and a test last performed in 2022 is not assurance for the current year.
- New warehouse system with no post-implementation review: change risk, unvalidated controls, possible data-integrity problems.
Reassess by asking what happens if the warehouse system or the vendor fails for a week. For a $600 million distributor, order fulfillment and revenue depend on it, so impact is high. With weak evidence of control, residual risk is at least medium-high. 120 hours (6% of the plan) is inconsistent with that rating. Document the revised assessment and its basis, since the committee approved the original rating.
2. Management says the vendor's 'right to audit' clause covers IT. How should the CAE respond?
Read the worked answer
A right-to-audit clause is a contractual mechanism, not evidence that controls are designed or operating. Three questions expose the gap: has the clause ever been exercised; does it reach subservice organizations and the specific systems in use; and who would perform the audit and bear the cost?
If the clause has never been used and no SOC 1 has been obtained, the organization is relying on the vendor's assurances - exactly the condition internal audit exists to test. The CAE should treat the clause as a potential source of evidence (schedule an exercise of it, or request a bridge letter or SOC 1 for the missing periods) and, until evidence exists, keep the risk rating elevated. 'Covered by contract' answers a legal question, not an assurance question.
3. The committee has fixed the plan at 2,000 hours. How should the CAE present the trade-offs?
Read the worked answer
Present a menu with consequences, not a complaint about resources.
- Reallocate: identify the lowest-risk engagements (for example, a recurring audit of a stable, well-controlled unit) and show the hours that could move to IT.
- Co-source the technical work (SOC 1 review, DR test observation) if internal skills, rather than hours, are the constraint.
- Phase: minimum viable coverage now (vendor control evidence, DR test, warehouse post-implementation review) and fuller coverage next year.
- Accept: if the committee declines all options, document the residual risk explicitly and record that the committee accepted it, with the impact stated - for example, 'no independent assurance over order-fulfillment systems for the year.'
State the assurance gap in plain terms. The committee is buying coverage with hours and should see what it is not buying. Silence would leave the committee believing IT is covered when the plan says otherwise.