CCB Third-Party & Vendor Risk Management 2

Question 1

What is the significance of the 'inherent risk' assessment in third-party risk management before controls are applied?

Accepted Answer

It establishes the baseline level of risk a vendor relationship poses before any controls or mitigations are considered

Answer

Inherent risk represents the raw or baseline risk of a vendor relationship without accounting for controls, providing the starting point for determining how much mitigation is needed and what residual risk will remain.

Question 2

Which regulatory framework specifically addresses third-party risk management requirements for financial institutions?

Accepted Answer

OCC Bulletin 2013-29 (Third-Party Relationships)

Answer

OCC Bulletin 2013-29 provides comprehensive guidance for national banks and federal savings associations on managing risks associated with third-party relationships, covering due diligence, contract provisions, oversight, and termination.

Question 3

A vendor risk assessment questionnaire (VRAQ) is BEST used to:

Accepted Answer

Gather standardized information about a vendor's security, compliance, and operational practices to support risk evaluation

Answer

A VRAQ systematically collects information about a vendor's policies, controls, certifications, and practices across risk domains, enabling the compliance team to evaluate risk before and during the vendor relationship.

Question 4

What does 'concentration risk' mean in the context of third-party risk management?

Accepted Answer

The risk arising from over-reliance on a single vendor or a small number of vendors for critical functions, which could cause systemic failure if that vendor fails

Answer

Concentration risk occurs when an organization depends too heavily on one or a few vendors for critical operations, meaning a vendor failure, outage, or exit would disproportionately disrupt the organization's business.

Question 5

When should a vendor risk assessment be formally updated or repeated?

Accepted Answer

At contract renewal, when material changes occur in the vendor's business or the relationship, and on a periodic schedule based on risk tier

Answer

Best practice requires reassessing vendor risk on a periodic schedule (more frequently for higher-risk vendors) and also upon triggering events such as contract renewal, significant changes in the vendor's ownership, financial health, or services provided.

(CCB) Certified Compliance and Business Specialist Practice Test

(CCB) Certified Compliance and Business Specialist Practice Test

CCB Third-Party & Vendor Risk Management 2