Which term describes the entity that evaluates the risk posed by obtaining services from another entity?

• A. Outsourcer
• B. Third party
• C. Fourth party
• D. Vendor

Answer: (A)

When you outsource a function, the organization initiating the move is the outsourcer. This is the entity that must evaluate the risks of obtaining services from another provider, deciding what risk levels are acceptable and what controls are needed in the contract. The external provider is the third party or vendor, whom you’re evaluating. A fourth party is typically an intermediary or service that monitors or manages risk across the chain, not the entity performing the initial risk assessment for the outsourcing decision. So the term that fits describes the organization doing the evaluation before engaging the external service.