Third-Party & Vendor Risk Management Flashcards

Which of the following best describes the primary purpose of a third-party risk management (TPRM) program in a compliance context?

Answer: To identify, assess, and mitigate risks posed by external parties that have access to company data, systems, or operations

A TPRM program is designed to systematically identify, assess, and mitigate the compliance, operational, and reputational risks that arise when third parties have access to an organization's data, systems, or business operations.

During vendor onboarding, a compliance officer conducts a due diligence review. Which document is MOST critical for assessing a vendor's own compliance posture?

Answer: The vendor's SOC 2 Type II report or equivalent third-party audit report

A SOC 2 Type II report (or equivalent independent audit) provides verified evidence of a vendor's security, availability, and processing integrity controls over a period of time, making it the most relevant document for assessing compliance posture.

What is 'fourth-party risk' in the context of vendor risk management?

Answer: Risk posed by the subcontractors and service providers used by your direct vendors

Fourth-party risk refers to the risk exposure that arises from the subcontractors, suppliers, and service providers that your direct (third-party) vendors rely upon, extending the risk chain beyond your immediate contractual relationships.

Which approach to vendor risk tiering is considered best practice?

Answer: Categorizing vendors by risk level (e.g., critical, high, medium, low) based on data access, criticality, and regulatory exposure

Risk-based tiering categorizes vendors according to their potential impact on the organization (considering data sensitivity, operational criticality, and regulatory exposure), allowing compliance resources to be focused where risk is greatest.

Under the OCC's third-party risk management guidance, which lifecycle stage requires the MOST ongoing monitoring activities?

Answer: Ongoing monitoring during the contract term

The OCC guidance emphasizes that ongoing monitoring throughout the life of the third-party relationship is critical, requiring continuous performance reviews, periodic reassessments, and incident tracking to manage risk effectively.

A compliance officer discovers that a critical vendor has suffered a data breach. What should be the FIRST action taken?

Answer: Activate the organization's incident response and breach notification protocols and assess the scope of exposure

The immediate priority is to activate incident response protocols, assess the scope of the organization's exposure, and fulfill any applicable breach notification obligations, which may be time-sensitive under laws like GDPR or state breach notification statutes.

Which contractual provision is MOST important for ensuring a vendor remains compliant with applicable laws and regulations throughout the contract term?

Answer: A representations and warranties clause combined with a right-to-audit provision

Representations and warranties require vendors to attest to their compliance status, while right-to-audit provisions give the organization the contractual ability to verify compliance, together forming the strongest contractual compliance safeguard.