Which activity BEST describes conducting due diligence of a lower risk vendor?

The principle of risk-based due diligence dictates that the level of assessment effort must be proportional to the vendor's risk level. For lower-risk vendors, a streamlined and efficient approach is most appropriate. Sending a lightweight, standardized questionnaire, such as the Shared Assessments Standardized Information Gathering (SIG) Lite, allows an organization to gather essential information about the vendor's control environment. This method fulfills due diligence requirements without imposing the significant resource burden associated with more intensive assessments, which are reserved for vendors posing a higher risk.

A. Conducting an on-site assessment of the vendor's facilities.

This is the most intensive and costly due diligence method, reserved for critical or high-risk vendors where direct verification of controls is necessary.

B. Reviewing the vendor's SOC 2 Type 2 report and audited financial statements.

This is a thorough and time-consuming review, more appropriate for moderate to high-risk vendors, especially those handling sensitive data or critical functions.

D. Forgoing all due diligence activities.

Neglecting due diligence for any vendor, regardless of risk level, is a failure of risk management and may violate regulatory and compliance obligations.

1. Shared Assessments. (2023). Certified Third Party Risk Professional (CTPRP) Body of Knowledge.

Section 3.2.2, "Scoping and Tiering": This section details the methodology of classifying vendors into risk tiers (e.g., high, medium, low). It explicitly states that the level and intensity of due diligence activities should directly correspond to the assigned risk tier. Low-tier vendors undergo a less rigorous assessment process.

2. Shared Assessments. (2023). Standardized Information Gathering (SIG) Questionnaire.

Document Purpose, "SIG Lite Questionnaire": The official documentation for the SIG describes the SIG Lite as being "designed for organizations that need a basic level of due diligence" and is "appropriate for third parties that are lower risk." This directly supports using a streamlined questionnaire for low-risk vendors.

3. The Santa Fe Group, Shared Assessments. (2020). Governing and Managing Third Party Risk.

Chapter 4, "The Third Party Risk Management Lifecycle - Due Diligence": This chapter emphasizes that a "one-size-fits-all" approach to due diligence is inefficient and ineffective. It advocates for a tiered approach where the depth of the assessment is driven by the inherent risk of the third-party relationship. For low-risk relationships, it suggests leveraging less resource-intensive tools like simplified questionnaires.