Which description matches a fourth party or subcontractor?

• A. Third party
• B. Outsourcer
• C. Fourth party
• D. Vendor

Answer: (C)

In risk management, a fourth party is the subcontractor that a third party engages to perform part of the services you rely on. You contract with a vendor to provide a service, and that vendor may rely on another company to handle components of that work. That downstream company—the subcontractor—is the fourth party to you. This distinction matters because the fourth party can impact your data security and controls, even though you don’t have a direct contract with them. So the description that matches a fourth party or subcontractor is the entity that a vendor uses to deliver the service.