Rule Atlas
ISO 27001: Auditing the Vendor and Third-Party Risk Lifecycle
Under ISO 27001 (ISACA / NIST / SOC 2), auditing the Vendor and Third-Party Risk Lifecycle establishes the authoritative rules tested on the ISACA CISA. Master the IS auditor's role in the complete vendor management lifecycle, from risk-based selection and contracting to ongoing monitoring using SOC reports and managing exit strategies. VoraPrep verifies every threshold, worked table, and practice question below against the current ISACA CISA blueprint.
Worked Example: Weighted Scoring for Vendor Selection
| Criteria | Weight | Description |
|---|---|---|
| Security Controls | 40% | Strength of IAM, encryption, and SOC 2 Type 2 report. |
| Functionality | 30% | Meets all specified payroll and HR features. |
| Cost | 20% | Total cost of ownership over three years. |
| Vendor Viability | 10% | Financial stability and client references. |
A regional bank is contracting with a niche FinTech provider for a critical, highly customized loan origination SaaS platform. The IS auditor, reviewing the draft agreement, notes that the FinTech provider is a small, venture-backed startup. The bank's primary concern is ensuring it can continue processing loans without major disruption if the FinTech provider is acquired, becomes insolvent, or discontinues the service. Which of the following contractual provisions should the IS auditor recommend as the MOST critical control to mitigate the risk of service discontinuation due to vendor failure?
Worked Example: Weighted Scoring for Vendor Selection
Scenario: An IS auditor is reviewing the selection process for a new cloud-based payroll provider at FinCorp. The audit committee wants assurance that the choice was objective. The auditor examines the evaluation matrix used to compare the top two vendors, 'PayRight' and 'SecurePay'.
- Step 1: Define and Weight Criteria The selection team, with input from IT, HR, and security, established criteria and assigned weights based on business priorities.
- | Criteria | Weight | Description | | :--- | :--- | :--- | | Security Controls | 40% | Strength of IAM, encryption, and SOC 2 Type 2 report. | | Functionality | 30% | Meets all specified payroll and HR features. | | Cost | 20% | Total cost of ownership over three years. | | Vendor Viability | 10% | Financial stability and client references. |
- Step 2: Score Each Vendor (1-5 scale) The team scores each vendor against the criteria.
- | Criteria | Weight | PayRight Score | SecurePay Score | | :--- | :--- | :--- | :--- | | Security Controls | 40% | 3 | 5 | | Functionality | 30% | 5 | 4 | | Cost | 20% | 5 | 3 | | Vendor Viability | 10% | 4 | 4 |
Common ISACA CISA Distractors on ISO 27001
- 1When you encounter a vendor management scenario on the CISA exam, use this 4-step framework to find the BEST answer:
- 2Step 1: Identify the Lifecycle Phase. Is the question about initial selection, contract negotiation, ongoing monitoring, or termination? The correct action depends heavily on the context.
- 3Step 2: Pinpoint the Primary Risk. What is the core issue in the scenario? Is it a lack of performance (SLA), a security vulnerability (SOC report), a legal exposure (contract clause), or a biased selection process? Focus on the greatest potential impact.
- 4Step 4: Adopt the Auditor's Mindset. The correct answer is what an IS auditor should do or recommend. This means focusing on evidence, objectivity, risk mitigation, and formal process, not on operational convenience or what the business manager might prefer.
- 5To remember the key phases of vendor management from an auditor's perspective, use the mnemonic S-C-O-M-E:
Frequently Asked Questions: ISO 27001
What is the core rule under ISO 27001 (Auditing the Vendor and Third-Party Risk Lifecycle)?
Under ISO 27001 (ISACA / NIST / SOC 2), auditing the Vendor and Third-Party Risk Lifecycle establishes the authoritative rules tested on the ISACA CISA. Master the IS auditor's role in the complete vendor management lifecycle, from risk-based selection and contracting to ongoing monitoring using SOC reports and managing exit strategies. VoraPrep verifies every threshold, worked table, and practice question below against the current ISACA CISA blueprint.
How is ISO 27001 tested on the ISACA CISA?
When you encounter a vendor management scenario on the CISA exam, use this 4-step framework to find the BEST answer: Step 1: Identify the Lifecycle Phase. Is the question about initial selection, contract negotiation, ongoing monitoring, or termination? The correct action depends heavily on the context.
Where can I practice ISACA CISA questions on Auditing the Vendor and Third-Party Risk Lifecycle?
Test yourself instantly with the free playable ISACA CISA question on this page, or launch VoraPrep's full ISACA CISA adaptive question bank, interactive lessons, and 1:1 exam simulator at voraprep.com/cisa.