Cyber Risk Visibility Depends on Shared Frameworks

 The Chief Technology Auditor at a major European bank has warned that understanding how vendor and internal controls combine to shape residual risk is one of the most persistent challenges in third-party risk management today.

In theory, risk management follows a simple model. Organizations identify inherent risk, apply controls, and assess the resulting residual risk. In practice, however, this becomes far more complex when third parties are involved.

“When you’re dealing with outsourced relationships, this picture gets more complicated,” the executive told CeFPro’s most recent Vendor Risk USA conference.

Vendors, he said, operate their own controls, organizations apply theirs, and the interaction between the two determines the final risk position. Achieving a clear view of this interaction is a daily challenge for many institutions.

The solution, he argued, lies in adopting common frameworks. These frameworks provide a shared language that enables organizations and vendors to communicate effectively.

“We want to make sure that what we call an apple, they call an apple,” he said.

Without this alignment, risk assessments become inconsistent and difficult to compare. Vendors may present control environments in one format, while organizations assess risk using another. This disconnect undermines decision-making.

Frameworks such as ISO standards and COBIT help bridge this gap. By mapping controls to a common structure, organizations can better understand how vendor and internal controls interact.