Supporting due diligence artifacts may include information about which of the following?

• A. Third party assessments (subcontractors)
• B. Company car details
• C. Office lease agreements
• D. Employee training schedules

Answer: (A)

In due diligence for third-party risk management, you gather documents that reveal how a vendor manages risk and oversees others in their supply chain. The strongest artifact is third-party assessments of subcontractors because they provide direct evidence about the risk posture of the vendor’s extended network. They show how subcontractors are managed, what controls are in place, and any audit findings or compliance statuses that could affect your organization.

The other items don’t align as closely with evaluating external risk. Company car details are operational and internal, not about the vendor’s risk controls. Office lease agreements relate to physical premises and may matter for certain business continuity considerations, but they don’t address the vendor’s risk management of its subcontractors. Employee training schedules reflect internal capabilities but don’t directly demonstrate how the vendor controls risk across its subcontracted work.

So, third-party assessments of subcontractors are the most relevant and informative artifacts for this purpose.