Accountability can't be outsourced

Exam

CISA & CISM

What it means

Activities can move to a vendor; accountability for the data and the outcome stays with the organization. Expect contract rights, assurance reports and monitoring in the right answer.

The trap answer looks like

The provider is responsible now, so the organization can stop worrying.

The winning answer looks like

Contract for assurance, monitor the provider and keep accountability inside the organization.

Worked example

Payroll is outsourced. What stays with the organization?

✅ Accountability for protecting employees' data

Operations can move. Accountability cannot.