The correct answer is B.

Third parties are not necessarily a common third-party risk. It is the use of third parties that increases a firm’s exposure to third-party risks. Third parties are providers of goods and services that are not internal to the firm.

Common third-party risks include service disruption, failings in service quality, fraud, accidental data privacy breach or intentional information leak, compliance breaches, espionage and IP theft, and reputational damage.

Things to Remember

• Third-party risk management involves identifying, assessing, and mitigating risks associated with outsourcing to third parties.
• Service disruption can occur when a third-party provider fails to deliver services as agreed, leading to operational disruptions for the firm.
• Accidental data privacy breaches can result from mishandling of sensitive information by third-party vendors, potentially leading to regulatory fines and reputational damage.
• Compliance breaches by third parties can expose the firm to legal and regulatory risks, especially if the third party fails to adhere to industry standards or regulations.