nerdexam
CompTIA

CAS-001 · Question #501

The Chief Executive Officer (CEO) of a large prestigious enterprise has decided to reduce business costs by outsourcing to a third party company in another country. Functions to be outsourced…

The correct answer is D. Improper handling of customer data, loss of intellectual property and reputation damage. When outsourcing functions that include customer data processing and software development to a third party, the most critical risks involve data mishandling, intellectual property theft, and resulting reputation damage.

Integration of Computing, Communications and Business Disciplines

Question

The Chief Executive Officer (CEO) of a large prestigious enterprise has decided to reduce business costs by outsourcing to a third party company in another country. Functions to be outsourced include: business analysts, testing, software development and back office functions that deal with the processing of customer data. The Chief Risk Officer (CRO) is concerned about the outsourcing plans. Which of the following risks are MOST likely to occur if adequate controls are not implemented?

Options

  • AGeographical regulation issues, loss of intellectual property and interoperability agreement issues
  • BImproper handling of client data, interoperability agreement issues and regulatory issues
  • CCultural differences, increased cost of doing business and divestiture issues
  • DImproper handling of customer data, loss of intellectual property and reputation damage

How the community answered

(25 responses)
  • A
    16% (4)
  • B
    4% (1)
  • C
    8% (2)
  • D
    72% (18)

Why each option

When outsourcing functions that include customer data processing and software development to a third party, the most critical risks involve data mishandling, intellectual property theft, and resulting reputation damage.

AGeographical regulation issues, loss of intellectual property and interoperability agreement issues

Interoperability agreement issues are an operational concern but are less critical than IP loss or customer data exposure given the functions being outsourced.

BImproper handling of client data, interoperability agreement issues and regulatory issues

While improper client data handling and regulatory issues are valid, interoperability agreement issues replace the more severe risk of intellectual property loss that is directly threatened by outsourcing development functions.

CCultural differences, increased cost of doing business and divestiture issues

Cultural differences and divestiture issues are business concerns, not the primary security or risk management risks the CRO would be focused on in this context.

DImproper handling of customer data, loss of intellectual property and reputation damageCorrect

Outsourcing back-office functions that process customer data directly creates risk of improper data handling if the third party lacks adequate controls. Software development and business analyst functions represent intellectual property that could be misappropriated. Both of these failures can cascade into significant reputation damage for the enterprise.

Concept tested: Outsourcing risk identification - data, IP, reputation

Source: https://www.isaca.org/resources/isaca-journal/issues/2016/volume-3/managing-risk-in-outsourcing

Topics

#outsourcing risk#third-party data handling#intellectual property#regulatory compliance

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-001 Practice