Which term describes entities that work on behalf of the organization but are not its employees?

• A. Third party
• B. Outsourcer
• C. Fourth party/subcontractor
• D. Vendor

Answer: (A)

The idea being tested is identifying external entities that perform work for an organization but aren’t employees. The broad term that covers all such entities is a third party. A third party can include vendors, contractors, consultants, and outsourcers—any external party engaged under a contract to help the organization achieve its goals. They are paid for their work and operate outside the organization’s payroll, yet they carry out activities on the organization’s behalf.

In practice, this umbrella term matters for third-party risk management: you’d conduct due diligence, establish contract controls, specify security and compliance obligations, and maintain ongoing oversight of these relationships.

The other terms describe more specific kinds of external relationships. An outsourcer focuses on taking over an entire function or process, which is a narrower definition. A vendor usually refers to a supplier of goods or standalone services, not necessarily someone who executes ongoing business work. A fourth party or subcontractor sits further down the chain, typically engaged by another provider rather than directly by the organization. So they describe parts of the relationship, but the broad, inclusive label that fits all such entities is third party.