Third-Party and Vendor Compliance Management Flashcards
7 cards from real CCM practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Third-Party and Vendor Compliance Management flashcards as text
What is the primary purpose of conducting due diligence on a third-party vendor before onboarding?
Answer: To assess the vendor's compliance risks and alignment with organizational standards
Pre-onboarding due diligence identifies legal, regulatory, reputational, and operational risks before the relationship begins, ensuring the vendor meets the organization's compliance standards.
Which contractual clause gives a company the legal right to examine a vendor's books, records, and operations to verify compliance?
Answer: Right-to-audit clause
A right-to-audit clause contractually allows the contracting organization to inspect a vendor's records and processes to confirm adherence to compliance requirements.
What is 'fourth-party risk' in a third-party risk management program?
Answer: Risk introduced by the subcontractors and service providers used by your direct vendors
Fourth-party risk refers to the exposure an organization faces from the vendors, subcontractors, or partners that its direct third parties rely upon, extending the risk chain beyond the immediate relationship.
When categorizing vendors by risk level, which factor most strongly suggests a vendor should be classified as HIGH risk?
Answer: The vendor has access to sensitive customer data and operates in a high-corruption jurisdiction
Access to sensitive data combined with operation in a high-corruption jurisdiction creates significant regulatory, reputational, and data privacy exposure, warranting a high-risk classification.
A vendor's compliance questionnaire response reveals it has no documented information security policy. What is the compliance manager's most appropriate immediate action?
Answer: Document the finding, request a remediation plan with timeline, and escalate if unresolved
Documenting the gap, requesting a remediation plan, and escalating if unresolved follows proper risk management protocol—allowing time for correction while maintaining accountability and an audit trail.
Which regulatory guidance specifically requires financial institutions to have a robust third-party risk management program covering due diligence, contract management, and ongoing monitoring?
Answer: OCC Guidance 2013-29 on Third-Party Relationships
OCC Guidance 2013-29 establishes that national banks and federal savings associations must implement comprehensive third-party risk management programs covering the full lifecycle of vendor relationships.
What is the most effective approach to managing compliance risk when a critical vendor is acquired by a competitor?
Answer: Conduct a reassessment of the vendor's compliance posture and renegotiate contract terms as needed
A change in ownership is a material event that may alter the vendor's compliance practices, data handling, and conflict-of-interest profile, requiring prompt reassessment and potential contract modifications.