{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"third_party","domain":["Third-Party / Supply-Chain Risk"],"inherent_rating":"medium","taxonomy":["basel-operational-risk","coso-erm-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Atprm-vendor-service-nonperformance","description":"Outsourced processing, IT, payroll/HR, print/mail, or sub-custodian providers fail to meet service levels, deliver defective software, make incorrect payments, or breach contractual deliverables, causing processing errors, outages, and loss.","details":{"category":"third_party","impact":"medium","inherent_rating":"medium","likelihood":"medium","risk_id":"tprm-vendor-service-nonperformance","taxonomies":["basel-operational-risk","coso-erm-risk"],"treatment":"mitigate"},"id":"risk:tprm-vendor-service-nonperformance","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Atprm-vendor-service-nonperformance","sourceIds":["ccpa","cobit-2019","dora","gdpr","hipaa","iso-27001","nis2","nist-800-53","nist-csf-2","nydfs-500","soc1","soc2"],"sourceUrl":null,"title":"Vendor/outsourcing service non-performance and disputes","type":"risk"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:11ba931f331b0ba94293ab12e87aa5f837c7ee771592b41dc6e5ade63b027943","properties":{"rationale":"Contractually defining deliverables and obligations before service begins creates enforceable recourse against non-performance.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-tprm-03-c9edcf93.json","sourceId":"uc:UC-TPRM-03","targetDetailPath":"/data/v1/records/risk-tprm-vendor-service-nonperformance-081f2fb9.json","targetId":"risk:tprm-vendor-service-nonperformance","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b377a036fbeb12acfa7e1489ea85ed71c46f9f4794f7be2991695249fb37ccbc","properties":{"rationale":"Agreeing service and exit terms and monitoring provider compliance governs external and cloud service delivery, directly addressing non-performance.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-tprm-08-6de49908.json","sourceId":"uc:UC-TPRM-08","targetDetailPath":"/data/v1/records/risk-tprm-vendor-service-nonperformance-081f2fb9.json","targetId":"risk:tprm-vendor-service-nonperformance","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b44a502c267cbbb4c4c68f3055dbad162310171d8323efe20a9ad1f563749592","properties":{"rationale":"Service-transition provisions at termination reduce the switching impact when moving off a non-performing vendor.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-tprm-06-0d2c1b90.json","sourceId":"uc:UC-TPRM-06","targetDetailPath":"/data/v1/records/risk-tprm-vendor-service-nonperformance-081f2fb9.json","targetId":"risk:tprm-vendor-service-nonperformance","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:ccd0e376207f2decfe033433db539cafbba762a294aff5120dfa29a56d500050","properties":{"rationale":"Defining, agreeing, and reviewing service agreements and supplier performance and operating lifecycle controls to address weaknesses directly targets non-performance.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-tprm-01-16b62053.json","sourceId":"uc:UC-TPRM-01","targetDetailPath":"/data/v1/records/risk-tprm-vendor-service-nonperformance-081f2fb9.json","targetId":"risk:tprm-vendor-service-nonperformance","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:db56c3f710400092df18918fea12a99dc0c95061f4eae24cda47936cee07a5ef","properties":{"rationale":"Assessing operational risk before engagement screens out likely non-performers, indirectly reducing later service-delivery failures.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-tprm-02-c35b26eb.json","sourceId":"uc:UC-TPRM-02","targetDetailPath":"/data/v1/records/risk-tprm-vendor-service-nonperformance-081f2fb9.json","targetId":"risk:tprm-vendor-service-nonperformance","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:f479ce0b4244aed02d135f5f4f2c664d09b05759e1b2aea66292db7cd8b0f346","properties":{"rationale":"Monitoring subservice-org performance against commitments and tracking identified issues to resolution directly detects and remediates service non-performance.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-access-21-14f45683.json","sourceId":"uc:UC-ACCESS-21","targetDetailPath":"/data/v1/records/risk-tprm-vendor-service-nonperformance-081f2fb9.json","targetId":"risk:tprm-vendor-service-nonperformance","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:fa7bb83970f87aca8d124a6705ff493a0e6d3eb5cfaf2968168727d982037956","properties":{"rationale":"Monitoring performance and service delivery against contractual and SLA requirements directly detects and drives remediation of non-performance.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-tprm-04-e6aef252.json","sourceId":"uc:UC-TPRM-04","targetDetailPath":"/data/v1/records/risk-tprm-vendor-service-nonperformance-081f2fb9.json","targetId":"risk:tprm-vendor-service-nonperformance","type":"mitigates"}],"schemaVersion":1}