Which description best defines a fourth party?

• A. An entity independent of and directly performing tasks for the assessee being evaluated
• B. The entity evaluating risk posed by obtaining services
• C. The entity that delegates a function to another entity
• D. An employee of the organization

Answer: (A)

In risk management, a fourth party is an external entity that directly performs work for the organization being assessed, sitting outside the organization itself and its primary supplier yet still delivering tasks for the organization through the service chain. This description fits best because it captures the idea of an independent external provider that is directly involved in delivering services to the assessee, extending the supply chain beyond the immediate contractor.

The other descriptions describe roles that don’t fit this concept: the entity evaluating risk is the assessor, not a party delivering services; the entity that delegates a function is typically the organization or its primary vendor that passes work along; and an employee is internal staff, not an external fourth party.