My manager and senior management at my company has requested due diligence feedback on a prospective vendor our company is thinking of doing business with. It is the same company I asked about in this question.
In reviewing their SOC report, I noticed non-standard language and presentation / formatting practices that deviate from the authoritative standards for SOC 2 exam as published by the AICPA. There is some specific wording in test procedures used by the independent external auditor I would have expected in a SOC report that was missing. The "tone" of vendor management feels very loose and it does not seem that they care very much about the exceptions raised by the auditors in the report.
The vendor is also critical per management and will have access to company data. As a result I do not feel entirely comfortable giving a clean recommendation to upper management to proceed with vendor consideration. However, I also do not want to be too dismissive based on what may be a misunderstanding on my part. I am thinking of talking to the vendor directly to try to gather more information and have passed this idea past my manager, who is supportive of this approach.
I am a pretty trusted and reliable in the eyes of my manager and senior manager so anything I say will carry weight in the final decision to proceed or not to proceed with consideration of this vendor. From the numbers SOC 1 / 2 attestations I did and have reviewed of other vendors in use at my company, this is the first time I have seen these issues. It is also the first time that my boss has seen it as well. Given company data will be accessed by this vendor, I am incline to err on the side of caution and recommend against further consideration.
Am I thinking about this situation correctly?
As the team lead, how do I communicate my unease without necessarily accusing the other party that they are not forthcoming or may be participating in unscrupulous practices?
