An organization learns that a third party has outsourced critical functions to another external provider.

According to the CISM Review Manual, the information security manager should evaluate the third party’s agreements with its external provider to ensure that the security requirements and controls are adequate and consistent with the organization’s expectations. Engaging or conducting an audit may be a subsequent step, but not the most important one. Recommending canceling the contract may be premature and impractical.

References = CISM Review Manual, 27th Edition, Chapter 3, Section 3.4.2, page 1431.