risk
Third-party compliance failure creating vicarious liability
A vendor, subcontractor, or channel partner violates labor, environmental, anti-bribery (FCPA/UKBA), or data-protection rules, exposing the company to liability and reputational harm; fourth-party/N-tier dependencies are opaque.
Record JSON · Open in map · Data retrieval guide
Catalog revision: 24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028. A connection does not establish full coverage.
Attributes
- category
- third_party
- domain
- Third-Party / Supply-Chain Risk
- Compliance, Audit & Assurance
- taxonomy
- enterprise-risk
- coso-erm-risk
- inherent_rating
- high
Details
- risk_id
- tprm-vendor-compliance-vicarious-liability
- category
- third_party
- likelihood
- medium
- impact
- high
- inherent_rating
- high
- treatment
- mitigate
- taxonomies
- enterprise-risk
- coso-erm-risk
Source
No record-specific source URL is provided.
Connections
- UC-TPRM-04 — Monitor vendor performance, services, and risk mitigates Third-party compliance failure creating vicarious liability
- strength
- related
- rationale
- Questionnaires, assurance-report review, and audits surface vendor compliance drift, reducing vicarious-liability exposure.
- UC-TPRM-02 — Perform risk-based due diligence before engaging vendors mitigates Third-party compliance failure creating vicarious liability
- strength
- related
- rationale
- Due diligence on operational risk and supply-chain exposure screens compliance-risky vendors, reducing downstream vicarious-liability exposure.
- UC-TPRM-03 — Bind vendors to security and privacy terms by contract mitigates Third-party compliance failure creating vicarious liability
- strength
- related
- rationale
- Contractual flow-down of compliance obligations, subcontractor terms, and audit rights creates recourse and deterrence that reduce vicarious-liability exposure.
- UC-ACCESS-21 — Manage subservice organizations supporting the system mitigates Third-party compliance failure creating vicarious liability
- strength
- related
- rationale
- Managing subservice (fourth-party) orgs and reviewing their assurance reports reduces the N-tier opacity that drives vicarious-liability exposure.
- UC-TPRM-01 — Operate a third-party security risk management program mitigates Third-party compliance failure creating vicarious liability
- strength
- related
- rationale
- Risk-based due diligence, a criticality-ranked register, sub-outsourcing conditions, and reassessment reduce the N-tier compliance-failure exposure driving vicarious liability.