CISA Governance & Management of IT: Third-Party Risk Management — Complete Study Guide

Vetting a third-party vendor is like choosing a climbing partner. The contract is just the rope; the real test is their judgment under pressure, which you can only verify through rigorous, ongoing due diligence—the exact mindset the CISA exam demands.

Key facts

• Official Body: ISACA (Information Systems Audit and Control Association)
• Relevant Domain: Domain 2: Governance and Management of IT (17% of exam)
• Exam Format: 150 multiple-choice questions
• Exam Duration: 4 hours (240 minutes)
• Passing Score: 450 on a scaled score of 200-800
• Pass Rate: ISACA does not publish official pass rates, but the exam is widely recognized for its difficulty.

ISACA reports that over 200,000 professionals have earned the CISA certification since its inception in 1978 (ISACA).

What is Third-Party Risk Management and Why It Matters for CISA

Third-Party Risk Management (TPRM) is the lifecycle of identifying and controlling risks when you use external vendors for IT services. For the CISA exam, this isn't about negotiating legal terms. It's about an auditor's ability to ensure that giving a third party access to your data and systems doesn't create unacceptable security, operational, or compliance vulnerabilities.

This topic is a major component of Domain 2: Governance and Management of IT, which accounts for 17% of your total score. The questions are rarely definitional. Instead, you'll face a scenario and be asked for the best, most important, or primary action an IS auditor should recommend.

The biggest mistake candidates make is treating vendor management as a one-time event at contract signing. The CISA exam tests it as a continuous lifecycle. Your concern must span from initial due diligence to ongoing monitoring and eventual contract termination. Memorization fails here; judgment is what's being tested. You can test your judgment with scenario-based questions to see where you stand.

How Can I Master CISA Third-Party Risk Management in 7 Days?

Let's get tactical with a week-long plan to build deep competence on this critical CISA topic.

Days 1-2: Master the Core Concepts

Your first two days are about mastering the vocabulary and foundational components. This is the bedrock for the judgment calls you'll make later.

• Due Diligence: The pre-contract investigation. The CISA exam focuses on technical due diligence: reviewing security policies, incident response plans, and past audit reports to assess the vendor's security posture.
• Service Level Agreements (SLAs): The most critical part of the contract for an IS auditor. An SLA must contain specific, measurable metrics for performance, such as uptime (e.g., 99.95%), incident response time, and mean time to recovery (MTTR). The exam will test if you can spot a weak, non-quantifiable SLA.
• Data Residency and Jurisdiction: You must know where your data will be stored and processed. A vendor operating in a different legal jurisdiction can expose your organization to different privacy laws and government access requests (e.g., GDPR in the EU). This is a frequent source of compliance risk.
• Software Escrow: A legal arrangement where a third party holds the source code for a vendor's application, releasing it if the vendor fails. This is a crucial business continuity control for custom-built, mission-critical applications, but it is irrelevant for commodity software like Microsoft Office.
• Subservice Organizations (SOC Reports): When your vendor uses its own vendors, you need assurance over their controls. System and Organization Controls (SOC) reports are the primary tool for this.

Report Type	Purpose	How It's Tested on the CISA Exam
SOC 1	Reports on controls relevant to a user entity's internal control over financial reporting.	The correct choice if the outsourced service impacts financial statements (e.g., payroll processing).
SOC 2	Reports on controls relevant to the Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, or Privacy.	The go-to report for most IT outsourcing (e.g., cloud hosting, SaaS platforms).
Type 1	Reports on the suitability of the design of controls as of a point in time.	A good starting point, but provides less assurance than a Type 2.
Type 2	Reports on the operating effectiveness of controls over a period of time (usually 6-12 months).	The "gold standard" for an auditor, as it proves controls were actually working.

Days 3-4: Map the Vendor Lifecycle

Now, connect the concepts to the process. The exam tests your understanding of the auditor's role at each stage.

1. Selection & Due Diligence: The auditor's role is to ensure the process is sound and that due diligence is proportional to the inherent risk of the service. High-risk vendors require much deeper investigation to reduce the residual risk to an acceptable level.
2. Contracting & Onboarding: The auditor verifies that contracts include key clauses: measurable SLAs, right-to-audit, data ownership, specific security requirements (e.g., encryption standards), and incident notification timelines.
3. Ongoing Monitoring: This is heavily tested. How do you ensure the vendor remains compliant? This involves reviewing performance against SLAs and Key Performance Indicators (KPIs), analyzing annual SOC reports, and tracking Key Risk Indicators (KRIs) that could signal deteriorating performance.
4. Termination & Offboarding: The relationship's end requires a formal exit strategy. The auditor must verify a process for the secure return or certified destruction of company data, revocation of all access credentials, and mitigation of any vendor lock-in.

Days 5-6: Apply Your Judgment with Practice Questions

This is where you build exam-day confidence. Work through as many scenario-based questions as possible. For every question, especially those you get wrong, articulate why the correct answer was best and why the distractor you chose was tempting but flawed.

The VoraPrep adaptive engine is designed for this phase. It learns your weak spots—like choosing between a SOC 1 and SOC 2 report—and serves you more questions testing that specific judgment call. Our platform has dozens of questions focused specifically on Third-Party Risk Management.

Day 7: Connect and Consolidate

On the final day, see the bigger picture. Understand how TPRM integrates with other CISA domains.

• Domain 1 (Auditing Process): A "right to audit" clause is the contractual basis for performing the audit work described in Domain 1. For more, see our guide on how auditors must adhere to IS Audit Standards and Guidelines.
• Domain 3 (IS Acquisition): The vendor selection and due diligence process in TPRM directly mirrors the system acquisition activities in Domain 3.
• Domain 5 (Protection of Information Assets): A vendor data breach immediately triggers the incident response and data protection principles from Domain 5.

Review your notes from the week, focusing on the explanations for questions you found difficult. This consolidates your understanding of the CISA mindset.

Worked Example: Choosing the Right Control

Let's walk through a typical CISA-style problem that requires you to weigh different risks.

> 💡 Worked example: > FinCorp, a regional bank, has outsourced the development and hosting of its new mobile banking application to CloudApp, a small but innovative tech startup. During a pre-implementation review, the IS auditor notes that the application will process sensitive customer financial data. Which of the following is the MOST important control for the IS auditor to verify is in place? > > A. A software escrow agreement for the application's source code. > B. A copy of CloudApp's corporate liability insurance certificate. > C. A recent SOC 2 Type 2 report for CloudApp's hosting environment. > D. A penalty clause in the contract for failure to meet development deadlines.

Step 1: Identify the Core Risk

The service is a mobile banking app processing sensitive customer data. The primary information systems risks are confidentiality (data breach), integrity (unauthorized transactions), and availability (service outage).

Step 2: Analyze the Options

• A. Software Escrow: This is a business continuity control protecting FinCorp if CloudApp goes bankrupt. It's important but doesn't address the daily operational risks of a data breach or service failure.
• B. Liability Insurance: This is a financial risk transfer control. It helps recover monetary damages after a breach has occurred. It does nothing to prevent the breach itself.
• C. SOC 2 Type 2 Report: This provides independent assurance that CloudApp's controls over security and availability were designed properly and operated effectively over time. This directly addresses the core IS risks.
• D. Penalty Clause: This is a contractual, financial control. It motivates the vendor but offers no direct assurance about the quality or security of their operations.

Step 3: Find the Tempting Wrong Answer

The most tempting wrong answer is (A) Software Escrow. Candidates see "custom application" and their brain flags "escrow." It's a valid TPRM control, making it a plausible distractor. However, the risk of vendor failure is a business continuity risk, while the risk of a data breach is a constant operational security risk. The CISA exam prioritizes controls that address the most immediate and probable IS risks.

Step 4: Select the Best Answer

The best answer is (C) A recent SOC 2 Type 2 report. It is the only option that gives the auditor direct, independent assurance over the effectiveness of the vendor's security and availability controls, which are the primary concerns here.

Practice Questions: Test Yourself on Third-Party Risk Management

Think through each question before revealing the explanation.

Question 1 During a review of third-party relationships, an IS auditor would be MOST concerned to find that:

Click for Explanation

The correct answer is B. Relying solely on a vendor's self-assessment for a critical provider presents the greatest risk. It lacks any independent verification of the vendor's control environment. (A) is a concern, but less so for a noncritical provider. (C) is a risk, but the complete lack of independent verification in (B) is a more fundamental failure of due diligence. (D) is poor practice but poses minimal information systems risk.

Question 2 An organization plans to outsource its payroll processing. From an IS auditor's perspective, which document is MOST important to review to gain assurance over the vendor's internal controls?

Click for Explanation

The correct answer is C. Payroll processing directly impacts financial reporting. A SOC 1 report, which focuses on internal controls over financial reporting, is the most appropriate document. A Type 2 report is superior because it covers the operating effectiveness of controls over time. (A) addresses financial viability, not internal controls. (B) is for security and other trust principles, less specific to the financial reporting risk of payroll. (D) is a legal protection, not an assurance report.

Question 3 A company outsources its critical customer relationship management (CRM) system to a SaaS provider. Which contract clause provides the GREATEST assurance of the provider's accountability?

Click for Explanation

The correct answer is C. The "right to audit" clause is the ultimate tool for accountability. It allows the organization to independently verify controls directly. While SLAs (B) are crucial for measuring performance, they don't provide the deep assurance of an audit. Insurance (A) is a financial recovery tool, not a preventative control. A compliance clause (D) is a promise, but the right to audit is the mechanism to verify that promise.

Want more? The VoraPrep CISA course includes over 2,300 practice questions, and our Vory tutor is available 24/7 to explain any concept. You can review the full CISA exam details and format breakdown on our site.

Related Resources

• CISA Governance & Management of IT: Organizational Structure and Roles — Complete Study Guide, Most CISA candidates study organizational structure like it's an HR exam, memorizing job titles and drawing org charts.
• CISA Information Systems Acquisition & Development: Project Governance — Complete Study Guide, Master CISA Project Governance for Domain 3. This complete 2026 study guide covers key concepts, a worked example, pract
• CISA Information Systems Operations & Resilience: Backup and Recovery Strategies — Complete Study Guide, Master CISA Backup and Recovery by learning the #1 judgment trap candidates fall into. This guide breaks down RPO vs. RT
• CISA Information Systems Auditing Process: Computer-Assisted Audit Techniques — Complete Study Guide, An auditor we coached, we'll call him David, was confident about Computer-Assisted Audit Techniques. He knew his SQL que
• CISA Protection of Information Assets: Adversarial Attacks — Complete Study Guide, Ace CISA Domain 5's Adversarial Attacks. This guide uses worked examples of BEC, zero-days, and APTs to teach the audito
• CISA Information Systems Auditing Process: Audit Objectives and Scope — Complete Study Guide, Pass CISA Domain 1 by mastering Audit Objectives and Scope. Our expert guide covers the audit charter, risk acceptance,

Official resources and references

• ISACA's Official CISA Page
• COBIT Framework from ISACA
• NIST Special Publication 800 Series

---

Frequently asked questions

How many questions on Third-Party Risk Management are on the CISA exam? This is a core topic within Domain 2, which is 17% of the exam. While the exact number varies, expect a proportional number of questions (around 5-10) that directly or indirectly test your knowledge of vendor management. What is the best way to study Third-Party Risk Management for CISA? Focus on scenario-based practice questions after learning the key terms. You must apply concepts like SOC reports and SLAs to realistic situations and select the best course of action for an auditor. Is Third-Party Risk Management tested in simulations? No, the CISA exam consists entirely of 150 multiple-choice questions. There are no simulations or written components on the current exam. How much time should I spend studying Third-Party Risk Management? Allocate approximately 15-20 hours of your total study time to third-party governance topics within Domain 2. Prioritize deep understanding of the concepts over rote memorization to develop the judgment the exam requires.

--- Ready to Pass Your CISA Exam?

Don't let tricky third-party scenarios derail your exam day. VoraPrep's adaptive learning platform targets your weak areas, and our 2,300+ practice questions are designed to teach you the judgment behind the rules. With our 24/7 Vory tutor, you're never stuck on a concept.

Visit voraprep.com to get started.

Start Your Free 14-Day Trial at voraprep.com →