An outsourcer's vendor risk assessment process includes all of the following EXCEPT:

A vendor risk assessment process is an externally focused set of activities designed to evaluate a specific third party's controls, policies, and operational resilience. This includes reviewing their attestation reports (like SOC 2), assessing their security and resiliency plans (like incident response), and analyzing their financial stability to ensure they are a viable partner.

Defining the outsourcer's own risk appetite is a foundational, internal governance activity. While the risk appetite informs and sets the criteria for the vendor assessment process (e.g., determining acceptable risk levels), it is not part of the assessment of the vendor itself. It is a prerequisite for the entire Third-Party Risk Management (TPRM) program.

A. Reviewing the vendor's SOC 2 report: This is a primary due diligence activity used to gain assurance over a vendor's controls, making it a core part of the assessment process.

B. Assessing the vendor's incident response plan: Evaluating a vendor's ability to respond to security incidents is a critical component of assessing their operational resilience and security posture.

C. Evaluating the vendor's financial viability: This is a crucial step in due diligence to ensure the vendor is a stable, long-term partner and to mitigate the risk of service disruption.

References

1. Shared Assessments, "The CTPRP Body of Knowledge."

Reference for Correct Answer (D): The BOK outlines the TPRM Lifecycle, where "Program Governance" (which includes defining risk appetite) is established first. The subsequent "Due Diligence" phase involves the assessment activities performed on the vendor. This structural separation confirms that defining risk appetite precedes and governs the assessment, but is not part of it.

Reference for Incorrect Options (A, B, C): The "Due Diligence" domain within the BOK explicitly details the requirement to collect and analyze evidence of a vendor's controls. This includes reviewing third-party attestations and audit reports (SOC 2), assessing business continuity and incident response plans, and evaluating financial health.

2. Shared Assessments, "Third-Party Risk Management Fundamentals."

Reference for Correct Answer (D): This foundational document explains that establishing a risk management framework, including risk appetite and tolerance, is an initial, internal step (Step 1: "Establish a risk management framework"). The assessment of third parties (Step 3: "Assess third parties") is a distinct, subsequent step in the process. This clearly separates the internal governance function from the external assessment activity.

1. Shared Assessments. Third Party Risk Management Framework (TPRMF), ver. 3.0, §3.1–3.5, pp. 18-25 – defines assessment steps; contract negotiation listed separately in §4.

2. Shared Assessments Program. Vendor Risk Management Maturity Model (VRMMM) v2.0, Domain 3 (Due Diligence & Risk Assessment), pp. 9-12 – lists required assessment activities but excludes contracting.

3. Brooks, P. & Plazaola, L. “Best practices in third-party cyber-risk assessment,” Journal of Cybersecurity, 2019;5(1):1-12, doi:10.1093/cybsec/tyz007 – distinguishes assessment from procurement/contract phases.