CCB Third-Party & Vendor Risk Management 2

Question 1

What is the significance of the 'inherent risk' assessment in third-party risk management before controls are applied?

Accepted Answer

It establishes the baseline level of risk a vendor relationship poses before any controls or mitigations are considered

Answer

It measures the risk that remains after all mitigating controls are in place

Answer

It quantifies the financial cost of the vendor relationship

Answer

It assesses the risk that a vendor will raise their prices

Question 2

Which regulatory framework specifically addresses third-party risk management requirements for financial institutions?

Accepted Answer

OCC Bulletin 2013-29 (Third-Party Relationships)

Answer

ISO 14001

Answer

OSHA 1910.119

Answer

GAAP ASC 606

Question 3

A vendor risk assessment questionnaire (VRAQ) is BEST used to:

Accepted Answer

Gather standardized information about a vendor's security, compliance, and operational practices to support risk evaluation

Answer

Replace the need for a formal contract with the vendor

Answer

Determine the vendor's profitability margins

Answer

Confirm the vendor's physical office location

Question 4

What does 'concentration risk' mean in the context of third-party risk management?

Accepted Answer

The risk arising from over-reliance on a single vendor or a small number of vendors for critical functions, which could cause systemic failure if that vendor fails

Answer

The risk that a vendor will dilute their focus by serving too many customers

Answer

The risk that vendor employees are too concentrated in one geographic area

Answer

The risk that a vendor concentrates too much sensitive data

Question 5

When should a vendor risk assessment be formally updated or repeated?

Accepted Answer

At contract renewal, when material changes occur in the vendor's business or the relationship, and on a periodic schedule based on risk tier

Answer

Only at initial onboarding and never again

Answer

Only when the vendor requests a review

Answer

Every 10 years regardless of circumstances

Question 6

Which of the following is an example of a 'right-to-audit' clause in a vendor contract?

Accepted Answer

A clause granting the organization the right to conduct on-site inspections or review vendor records to verify compliance with contractual and regulatory requirements

Answer

A clause that allows the vendor to audit the organization's financials

Answer

A clause requiring the vendor to hire a specific accounting firm

Answer

A clause limiting the number of invoices the vendor can submit

Question 7

In the context of GDPR and third-party risk, what is a 'Data Processing Agreement' (DPA)?

Accepted Answer

A legally required contract between a data controller and a data processor that specifies the terms under which personal data may be processed on behalf of the controller

Answer

An agreement requiring the vendor to delete all data after each transaction

Answer

A financial agreement governing data storage costs

Answer

An internal policy governing how employees handle data