Exam CISA topic 1 question 28 discussion

A for alpha

During due dil, third party policies are reviewed alongside Soc2 report or any certication they hold. Answer should be D

Answer: B

regulatory issue

The question is related to "regulatory requirements". SO correct answer is D.

if the third party has not been indicated expectations (regulatory requirements) - there is little hope of compliance

It is D

why not B please?

I think answer is C. If we reviewed other parties policies and procedures and do due diligence activities then even we couldnt submit our requirements it may be low or medium risk, because maybe we already check if third party is compliant. But if policies/procedures are not checked or due diligence performed that means we don't have any third party risk management that makes it high risk finding. Even we submit our requirements maybe other is not followed them.

Why doesn't C take precedence over D