Managing Risk from Processes, Third Parties, and Emerging Sources is the CRISC competency of identifying, assessing, and responding to risks that originate outside the organization's direct control — specifically from business processes dependent on external vendors, supply chain partners, SaaS platforms, and novel threat categories (AI/ML-based attacks, open-source library compromises, quantum threats, geopolitical supply chain disruptions). It is the practice of extending the organization's risk response posture beyond its own perimeter to cover every external dependency that could impair operations, expose data, or trigger regulatory liability.
Where it stops · what it isn't
- —IS: Risk response strategies specific to third-party vendors, supply chain partners, outsourced processes, and emerging threat categories not yet covered by traditional control frameworks.
- —IS: Continuous monitoring, risk scoring, contractual controls, and governance reporting for external dependencies.
- —IS: Adaptive risk management for emerging sources — zero-days, AI model poisoning, open-source vulnerabilities — that require dynamic rather than static responses.
- —IS NOT: Generic risk treatment options (mitigate/accept/avoid/transfer) in the abstract — those are covered in the sibling competency 'Risk Treatment and Response Options.' This competency applies those options specifically to third parties and emerging sources.
- —IS NOT: Internal process risk management where the organization controls all inputs and outputs.
- —IS NOT: Risk and Control Ownership governance — covered in the sibling competency 'Risk and Control Ownership,' though ownership must be clearly assigned as part of every third-party risk response.
- —IS NOT: A vendor procurement or contract management function — risk response here is a governance and assurance activity, not a purchasing one.
Connected concepts in the graph
Every cubelet sits in a knowledge graph. Here's what this one connects to.
PART OFCRISC Domain 3: Risk Response and Reporting
RELATED TORisk Treatment and Response OptionsRisk and Control OwnershipControl Types, Standards, and Frameworks
REQUIRESRisk Identification and Assessment (CRISC Domain 1)Risk Quantification and Prioritization
ENABLESRisk and Control Ownership (assigns owners to third-party risk response actions)Board and Regulatory Risk Reporting
CONSTRAINSVendor Selection and Contract Negotiation (risk posture shapes contractual requirements)