CCEP Third-Party Risk Management 2

Question 1

What is the recommended first step when onboarding a new third-party vendor?

Accepted Answer

Conducting a risk assessment to determine the appropriate level of due diligence

Answer

Signing the contract and beginning work immediately to save time

Answer

Scheduling an annual compliance audit at the start of the relationship

Answer

Requiring the third party to attend mandatory in-person training before any contact

Question 2

Which type of third party typically requires the most rigorous due diligence under anti-corruption compliance frameworks?

Accepted Answer

Government-facing sales agents operating in high-risk countries

Answer

Office supply vendors with no access to sensitive data

Answer

Janitorial service providers operating within company facilities

Answer

IT hardware suppliers providing commodity equipment

Question 3

What is 'fourth-party risk' in the context of third-party risk management?

Accepted Answer

Risk arising from sub-vendors or service providers that your direct third parties engage

Answer

The risk posed by a company's fourth-largest vendor by contract value

Answer

Risk associated with renewing contracts in their fourth year

Answer

The risk of maintaining more than four active third-party relationships simultaneously

Question 4

How does the EU General Data Protection Regulation (GDPR) specifically affect third-party risk management?

Accepted Answer

It requires companies to execute Data Processing Agreements with third parties that handle personal data

Answer

It prohibits all sharing of personal data with third parties under any circumstances

Answer

It limits due diligence obligations to financial risk assessment only

Answer

It applies only to third parties whose headquarters are within the European Union

Question 5

What action should a compliance team take if a third party fails a compliance audit?

Accepted Answer

Assess the severity of findings, require remediation, and decide whether to continue the relationship

Answer

Immediately terminate the contract without further investigation

Answer

Ignore the findings if the third party is a critical or sole-source supplier

Answer

Transfer all compliance liability to the third party through a written amendment

Question 6

What is the primary purpose of obtaining a compliance certification from a third party?

Accepted Answer

To obtain a formal attestation that the third party meets required compliance and ethical standards

Answer

To legally transfer all liability from the company to the third-party vendor

Answer

To eliminate the ongoing need for third-party monitoring and audits

Answer

To substitute for background checks on third-party personnel

Question 7

What is the significance of 'beneficial ownership' information in third-party due diligence?

Accepted Answer

It reveals the actual individuals who own or control the third party, which may uncover conflicts of interest or sanctions exposure

Answer

It identifies which party will benefit most financially from the contract

Answer

It determines the tax benefits the company will receive from the vendor relationship

Answer

It is relevant only for publicly traded vendors subject to securities disclosure