The Qualified Vendor Report
You are the risk and compliance lead at a payments firm. A critical cloud vendor's contract renews in 30 days at £1.2m annually. The vendor provides a SOC 2 Type II report covering the last 12 months; the auditor's opinion is unqualified except for one carve-out: logical access reviews for the production database were not performed in two of four quarters, and the vendor's management response says the control was 'compensated by manual monitoring'. The vendor hosts cardholder data, so PCI DSS applies. The business owner wants to renew immediately to avoid service disruption and says the vendor has 'never had an incident'. Your firm's third-party risk policy requires a current assurance report with no material exceptions for Tier 1 vendors, or a documented risk acceptance by the CRO. The CRO is on leave for two weeks. The procurement director asks you to 'just approve it' because the renewal is operational.
1. Assess the SOC 2 exception and classify the risk. What does the carve-out mean for PCI DSS and for the firm's reliance on the report?
Read the worked answer
A SOC 2 Type II report tests design and operating effectiveness over a period. An exception in two of four quarters means the control did not operate effectively for half the period. Logical access reviews for the production database are a core control for restricting access to cardholder data. Under PCI DSS, access must be limited to those with a business need, privileged access must be managed, and access reviews are expected at defined intervals. The carve-out is therefore relevant to PCI DSS compliance, not a cosmetic audit point.
The management response says the control was 'compensated by manual monitoring'. That is an assertion, not an auditor conclusion. You need evidence: what monitoring, by whom, what it detects, how often, and whether it would catch inappropriate access. The auditor did not remove the exception, so the report remains qualified for that control.
Classify the risk as high inherent risk: Tier 1 vendor, cardholder data, and a gap in a preventive access control. Likelihood of unauthorised access may be moderate, but impact is high - card data breach, regulatory action, fines, and reputational damage. Under the policy, a material exception for a Tier 1 vendor requires CRO risk acceptance. A missing quarterly access review for the production database is likely material because it is a key PCI control. The vendor's 'never had an incident' claim is weak evidence; it may reflect detection weakness rather than strong control.
2. What can you approve, and what must you refuse or escalate under the policy?
Read the worked answer
You can approve operational continuation only with an interim compensating control that has evidence and a time-bound remediation plan. You cannot approve the renewal as compliant, and you cannot sign off the exception yourself. The policy requires CRO risk acceptance for a material exception, so your role is to prepare the assessment and escalate, not to absorb the risk.
What you can do:
- Document the exception and its PCI DSS relevance.
- Request vendor evidence: current privileged access review, list of privileged users, manual monitoring logs, and the remediation plan with dates.
- Assess whether the interim monitoring genuinely reduces the risk.
- Prepare a one-page risk acceptance memo for the CRO or the named delegate.
Because the CRO is on leave, find the delegation of authority. Do not accept the procurement director as risk owner; they can accept business disruption risk, not compliance risk. Escalate to the deputy CRO, the CIO, or the audit committee chair under the documented delegation. If no delegate exists, escalate to the CEO. The 30-day deadline does not override the policy. If service continuity is genuinely at risk, ask legal about a short-term extension or a conditional renewal with a remediation clause, subject to the same escalation.
3. Recommend a path to renewal before the deadline, including vendor actions, contract terms, escalation, and documentation.
Read the worked answer
Run two tracks in parallel: assurance and continuity.
Vendor actions: request evidence of the manual monitoring for the two deficient quarters, a completed current access review, the full privileged user list, and a remediation plan with named owners and dates. Ask for the next SOC 2 report within 30 days of issuance and confirmation of the PCI DSS attestation.
Contract terms: use legal to add a security addendum with remediation milestones, a right to audit, a requirement to notify access-review failures, service credits, and termination rights if milestones are missed. If the vendor will not agree, that is itself a risk signal.
Escalation: brief the CRO's delegate with the risk assessment and a recommended decision: accept with conditions, accept for a short period, or do not renew. If the delegate is unavailable, escalate to the audit committee chair or CEO under the delegation of authority. Keep the business owner informed but do not let urgency redefine authority.
Documentation: record the exception, the evidence reviewed, the residual risk, the decision-maker, the conditions, and the review date. If risk acceptance is granted, set a 90-day check. If it is refused, approve a short extension to avoid service lapse while finding an alternative or requiring remediation before renewal. 'Just approve it' would breach policy and leave you holding a risk you have no authority to accept.