Written and reviewed by Angel Montilla · Updated
Provider oversight
Five questions to ask your IT provider about control evidence
Your IT provider may perform important work that your leadership and compliance team rarely see. A useful oversight conversation makes that work and its boundaries easier to understand.
The goal is to agree on responsibilities and evidence, using the provider’s existing reporting where it is useful. These five questions are a practical starting point.
1. Which controls do you operate, and which actions remain with us?
Ask for a clear division of responsibilities for the systems in scope. A provider may administer an application while your firm approves access or decides which permissions a role needs.
Identify those handoffs. A general statement that a system is “managed” may leave important approvals or reviews unassigned.
2. What records can show that the work was performed?
Discuss evidence appropriate to the control. A ticket may document an access change; a review record may show who examined a user list and how exceptions were handled.
Agree the relevant period and level of detail. Collecting large amounts of data without a review question adds effort without necessarily improving understanding.
3. How are exceptions reported and resolved?
Ask how the provider identifies work that could not be completed, who is informed and what record supports closure.
Some issues require a decision by your firm, such as approving a change or accepting a temporary exception. Those decisions should have a named owner rather than remaining in an email thread without a next step.
4. How would we coordinate during an incident or disruption?
Confirm the contact route and the division of responsibilities for assessment, technical response and business decisions. Ask what information the provider can make available and which activities require a separate service.
A tabletop discussion can expose assumptions about availability or authority that routine reporting does not reveal.
5. What should we review when the service changes?
New applications, subcontractors, integrations or changes in service scope can affect responsibilities and the evidence your firm needs.
Agree how significant changes will be communicated and who will decide whether an existing review or procedure needs to be updated.
Turn the conversation into a usable record
Capture the agreed responsibilities, unresolved questions and next actions. Keep the record proportionate to the systems and risks involved.
The result should help your firm and provider work together with fewer assumptions about who does what.