mediumMultiple Choice
CRISC Practice Question: Conducting a risk assessment of a critical…
A company is conducting a risk assessment of a critical third-party service provider. Which of the following is the BEST source of information to identify risks associated with the provider's sub-processors?
⚠ Common exam trap
It's easy for candidates to choose SOC 2 Type II reports of the primary provider (Option C) thinking they cover all downstream risks, but they typically exclude sub-processor controls unless specifically scoped.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The provider's documented vendor risk management program and audit reports of sub-processors
The provider's documented vendor risk management program and audit reports of sub-processors are the best source because they directly detail the controls, security posture, and compliance status of the sub-processors. This information is specific to the sub-processors' operations, unlike general reports or contracts that may not cover their unique risks. It enables the company to assess third-party and fourth-party risks as part of a comprehensive IT risk identification process.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The provider's documented vendor risk management program and audit reports of sub-processors
Why this is correct
The provider's vendor risk management programme and sub-processor audit reports give direct, independent evidence of how fourth parties are controlled, satisfying the need to identify risks beyond the provider itself. Audits test actual controls, whereas questionnaires rely on self-reporting, so this source best exposes inherited and concentration risk.
- ✗
Service level agreements in the contract
Why it's wrong here
SLAs define performance and availability commitments of the primary provider, not the identity, controls or risks of its sub-processors. They are the right source when assessing contractual service guarantees. Identifying sub-processor risk requires the provider's sub-processor inventory or flow-down audit evidence.
- ✗
SOC 2 Type II reports of the primary provider
Why it's wrong here
A SOC 2 Type II report covers the primary provider's own control environment over a period; it typically excludes or only partially addresses sub-processors. It is the correct source for assurance over the provider's internal controls. Sub-processor risk needs the provider's sub-processor list and their independent assurance reports.
- ✗
Public announcements of data breaches involving the provider
Why it's wrong here
Public breach announcements are reactive, incomplete and cover only incidents already disclosed, so they cannot systematically identify sub-processor risk. They are useful for monitoring reputational events. A structured assessment requires the provider's sub-processor inventory and flow-down control evidence.
Go deeper
Related to this question
About these practice questions
This CRISC question is part of Courseiva's 1,062-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.