Who Owns the Risk?
A fintech runs customer onboarding on a cloud platform. A security review finds that a third-party analytics vendor has read access to a production database containing partial card data. The vendor was engaged by the marketing team without IT or security review, and there is no data-processing agreement on file. The platform team says the vendor is 'marketing's problem'; marketing says 'IT owns the database'. The risk register has no entry for third-party data access. Regulators require breach notification within 72 hours, and the firm has no tested process for vendor-related incidents. The board asks: who is accountable, what is the exposure, and what do we do first?
1. Establish accountability and describe the exposure. Explain why 'it's marketing's problem' is not a valid position.
Read the worked answer
Accountability sits with the organisation, not a team. The firm is the data controller and bears regulatory responsibility for who accesses card data, regardless of which team engaged the vendor. Marketing owns the vendor relationship; the platform team owns the system; but neither owns the risk, which is why it fell through the gap.
Exposure:
- Uncontrolled third-party access to production card data: confidentiality and regulatory risk.
- No data-processing agreement: weak contractual and legal standing.
- No risk register entry: the risk is invisible to governance, so it cannot be managed or reported.
- No tested vendor-incident process: the 72-hour clock could be missed, compounding harm.
'Marketing's problem' fails because risk ownership cannot be delegated to whichever team happens to have signed the contract; the board is accountable and needs a single owner with authority.
2. Recommend the immediate actions and the order in which to take them.
Read the worked answer
Sequence by risk reduction first, then governance:
- Contain: review or suspend the vendor's access pending assessment; confirm what data was actually reachable and whether any access occurred.
- Assess: determine whether a notifiable incident exists; if uncertain, treat as potential and prepare notification.
- Contract: put a data-processing agreement in place before restoring access.
- Record: enter the risk on the register with an owner, rating, and treatment plan.
- Process: define and test a vendor-incident path that starts the 72-hour clock and names who decides to notify.
Do containment and assessment before paperwork, because access is live now. But do not restore access until the agreement exists, or the same gap reopens.
3. What governance changes would prevent this recurring, and how would you evidence them to the board?
Read the worked answer
Preventive controls:
- A procurement gate: no third-party access to production data without security and IT review and a signed agreement.
- A third-party/supplier risk process feeding the risk register, with periodic access reviews.
- Clear accountability: a named owner for third-party data risk, not a diffuse 'IT vs marketing' split.
- A tested incident-response process covering vendors, with the 72-hour notification decision defined.
Board evidence:
- Risk register showing the item, owner, and treatment status.
- A count of third-party integrations with agreements and access reviews complete (target 100%).
- Results of an incident-response test, including time to decision on notification.
- A reduction in unvetted vendor access over time.
This turns a one-off finding into a governed control the board can see and challenge.