FAQ: What should we track if we manage third-party risk manually?

Keep a shared register that lets a colleague see why a service was accepted and what still needs attention. Include:

Service and owner: vendor, service, and responsible internal owner.
Exposure: business importance, data or system access, and important dependencies.
Decision: review outcome and links to supporting records.
Follow-up: unresolved issues, action owners, and target dates.
Next review: date or change that should trigger another assessment.

Link supporting records rather than copying everything into the spreadsheet. Restrict access to sensitive records, keep version history, and assign someone to follow up on overdue actions.

Read more: Can We Manage Third-Party Risk Without Dedicated Software?.

Additional FAQs

How can we share audit evidence without exposing unnecessary sensitive data?

Agree on a secure sharing method and limit access to the people who need the evidence. Before uploading, check for credentials, customer content, personal information, and unrelated records. Ask the

What does the auditor mean by a complete population?

The population is the full set of relevant items from which testing may be performed, such as all production changes or all employee departures during the period. Start by agreeing

How do we know when spreadsheets are no longer enough?

Look for repeated failures in coordination, not just team size. Warning signs include broken evidence links, unclear ownership, conflicting versions, missed reviews, and excessive time reconciling records. Measure where the

What is covered in the Availability criteria?

The Availability criteria address whether information and systems are available for use as needed to meet the service commitments and system requirements in scope. Practical work includes capacity planning, monitoring,

Can different vendors still leave us dependent on the same provider?

Yes. Two vendors may use the same cloud service, identity provider, or other essential supplier. One disruption could affect both. Compare dependencies across important services, including your backup option. Look

How do we keep recurring SOC 2 tasks from being missed?

Create a calendar from the actual controls, not from a generic monthly checklist. Include the owner, backup, due date, evidence required, and escalation contact for each recurring activity. Add event-driven

Contact a SOC provider

Vulnerability assessment & penetration testing

Get Our Emails

SOC Reporting Guide