Insights
Field notes from outsourcing risk audits — written for compliance, risk, and operations leads.
What “material outsourcing” should mean in practice
Registers often list every vendor. Reviewers ask which ones can stop the business. Here is how to draw that line before an audit.
Fourth parties hiding behind your primary vendors
Your cloud or KYC partner may rely on subcontractors you never assessed. Sampling is how you find them.
Exit plans that survive a tabletop exercise
Exit clauses look tidy until someone asks who returns the data and who stands up the alternative service.