Rule Atlas
SOC 2: Auditing Third-Party Risk Management (TPRM)
Under SOC 2 (ISACA / NIST / SOC 2), auditing Third-Party Risk Management (TPRM) establishes the authoritative rules tested on the ISACA CISA. Master the Third-Party Risk Management (TPRM) lifecycle, from due diligence to offboarding. VoraPrep verifies every threshold, worked table, and practice question below against the current ISACA CISA blueprint.
Vendor Risk Assessment Techniques
| Assessment Method | Level of Assurance | Auditor Focus |
|---|---|---|
| SOC 2 Type 2 Report | High | Provides independent assurance on controls' design and operating effectiveness over a period (typically 6-12 months). The best evidence for critical vendors. |
| SOC 2 Type 1 Report | Moderate | Assesses control design at a single point in time. Less valuable than a Type 2 as it doesn't confirm the controls worked over time. |
| ISO 27001 Certification | Moderate | Confirms the vendor has a formal Information Security Management System (ISMS), but does not test the effectiveness of individual controls. |
| Questionnaires (e.g., SIG, CAIQ) | Low | Self-attested answers from the vendor. Useful for initial screening or for lower-risk vendors, but not independently verified. |
| On-Site Audit | Very High | Provides direct evidence but is costly, intrusive, and often reserved for the most critical, high-risk vendors. |
A global manufacturing company relies on a third-party service provider for its payroll processing. An IS auditor reviewing the third-party risk management program notes that while initial due diligence was performed three years ago, there have been no subsequent periodic reviews of the provider's controls, and the contract lacks a right-to-audit clause. What is the MOST significant concern for the IS auditor?
Worked Example: Auditing a Cloud Vendor
Scenario: An IS auditor is reviewing the onboarding process for 'SaaSify,' a new cloud provider that will host customer PII for a regional bank.
- Step 1: Review Due Diligence Documentation: The auditor requests the risk assessment performed by the bank's security team. The assessment classifies SaaSify as a high-risk vendor due to the sensitive data involved. Step 2: Examine Vendor-Provided Evidence: The bank's team provides the auditor with SaaSify's most recent SOC 2 Type 2 report and their ISO 27001 certificate. The auditor reviews the SOC report's user control considerations and notes any exceptions listed by the independent auditor. Step 3: Analyze the Contract: The auditor scrutinizes the Master Service Agreement (MSA). They find a strong data encryption clause and a 24-hour incident notification requirement. However, they discover there is no explicit 'right-to-audit' clause. Step 4: Formulate the Finding and Recommendation: The finding is that the contract with a high-risk vendor lacks a right-to-audit clause, limiting the bank's ability to ensure future compliance and perform direct assessments. Therefore, the most important recommendation is for management to renegotiate the contract to include a right-to-audit clause before the service goes live.
- The tempting-but-wrong answer might be to accept the SOC 2 report as sufficient. While a clean SOC 2 report provides excellent assurance for a past period, it does not guarantee future performance or provide a legal basis for the bank to investigate a future incident. The right-to-audit clause is the essential, forward-looking control that grants the organization power to verify controls on its own terms if needed.
Common ISACA CISA Distractors on SOC 2
- 1Use this framework to dissect any TPRM scenario on the CISA exam:
- 2TPRM is a Lifecycle: Effective vendor risk management is a continuous process (I-COT: Identify, Contract, Ongoing Monitoring, Terminate), not a one-time checklist.
- 3The Contract is King: The 'right-to-audit' clause is a non-negotiable for critical vendors. It is the foundation of your ability to gain assurance.
- 4Assurance Varies: Not all evidence is equal. A SOC 2 Type 2 report provides significantly more assurance about control effectiveness than a self-assessed questionnaire or a Type 1 report.
- 5Auditor's Focus is Risk: Your primary role is to provide assurance that the organization's process for managing third-party risk is effective, not just that vendors are meeting performance targets.
Frequently Asked Questions: SOC 2
What is the core rule under SOC 2 (Auditing Third-Party Risk Management (TPRM))?
Under SOC 2 (ISACA / NIST / SOC 2), auditing Third-Party Risk Management (TPRM) establishes the authoritative rules tested on the ISACA CISA. Master the Third-Party Risk Management (TPRM) lifecycle, from due diligence to offboarding. VoraPrep verifies every threshold, worked table, and practice question below against the current ISACA CISA blueprint.
How is SOC 2 tested on the ISACA CISA?
Use this framework to dissect any TPRM scenario on the CISA exam: TPRM is a Lifecycle: Effective vendor risk management is a continuous process (I-COT: Identify, Contract, Ongoing Monitoring, Terminate), not a one-time checklist.
Where can I practice ISACA CISA questions on Auditing Third-Party Risk Management (TPRM)?
Test yourself instantly with the free playable ISACA CISA question on this page, or launch VoraPrep's full ISACA CISA adaptive question bank, interactive lessons, and 1:1 exam simulator at voraprep.com/cisa.