{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"third_party","domain":["Third-Party / Supply-Chain Risk","Compliance, Audit & Assurance"],"inherent_rating":"high","taxonomy":["enterprise-risk","coso-erm-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Atprm-vendor-compliance-vicarious-liability","description":"A vendor, subcontractor, or channel partner violates labor, environmental, anti-bribery (FCPA/UKBA), or data-protection rules, exposing the company to liability and reputational harm; fourth-party/N-tier dependencies are opaque.","details":{"category":"third_party","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"tprm-vendor-compliance-vicarious-liability","taxonomies":["enterprise-risk","coso-erm-risk"],"treatment":"mitigate"},"id":"risk:tprm-vendor-compliance-vicarious-liability","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Atprm-vendor-compliance-vicarious-liability","sourceIds":["ccpa","cobit-2019","dora","gdpr","hipaa","iso-27001","nis2","nist-800-53","nist-csf-2","nydfs-500","soc1","soc2"],"sourceUrl":null,"title":"Third-party compliance failure creating vicarious liability","type":"risk"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2e3ae93648bf8b35bfcb513a4b4f60cf1b825e2af925b9834ada14d699c57067","properties":{"rationale":"Questionnaires, assurance-report review, and audits surface vendor compliance drift, reducing vicarious-liability exposure.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-tprm-04-e6aef252.json","sourceId":"uc:UC-TPRM-04","targetDetailPath":"/data/v1/records/risk-tprm-vendor-compliance-vicarious-liability-0215657c.json","targetId":"risk:tprm-vendor-compliance-vicarious-liability","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:4e73362f2e848fcf1c818a275c33ac071b210bbb27dd47b78dc4b69004fa5ef2","properties":{"rationale":"Due diligence on operational risk and supply-chain exposure screens compliance-risky vendors, reducing downstream vicarious-liability exposure.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-tprm-02-c35b26eb.json","sourceId":"uc:UC-TPRM-02","targetDetailPath":"/data/v1/records/risk-tprm-vendor-compliance-vicarious-liability-0215657c.json","targetId":"risk:tprm-vendor-compliance-vicarious-liability","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7a4fcf47042ea9982abc5f27817a6fafef13967f6bdb8024af9b65241982ffb6","properties":{"rationale":"Contractual flow-down of compliance obligations, subcontractor terms, and audit rights creates recourse and deterrence that reduce vicarious-liability exposure.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-tprm-03-c9edcf93.json","sourceId":"uc:UC-TPRM-03","targetDetailPath":"/data/v1/records/risk-tprm-vendor-compliance-vicarious-liability-0215657c.json","targetId":"risk:tprm-vendor-compliance-vicarious-liability","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:af910a9af8c30042de1c8f34c929a5e7453706e1ba5b60bf791f0dd6b71c2e91","properties":{"rationale":"Managing subservice (fourth-party) orgs and reviewing their assurance reports reduces the N-tier opacity that drives vicarious-liability exposure.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-access-21-14f45683.json","sourceId":"uc:UC-ACCESS-21","targetDetailPath":"/data/v1/records/risk-tprm-vendor-compliance-vicarious-liability-0215657c.json","targetId":"risk:tprm-vendor-compliance-vicarious-liability","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b0f240d0bb2e0ebdc690ff63fa6b509a1063b8fad26027a37b7d9e376b2fe859","properties":{"rationale":"Risk-based due diligence, a criticality-ranked register, sub-outsourcing conditions, and reassessment reduce the N-tier compliance-failure exposure driving vicarious liability.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-tprm-01-16b62053.json","sourceId":"uc:UC-TPRM-01","targetDetailPath":"/data/v1/records/risk-tprm-vendor-compliance-vicarious-liability-0215657c.json","targetId":"risk:tprm-vendor-compliance-vicarious-liability","type":"mitigates"}],"schemaVersion":1}