Third-Party and Vendor Compliance Management Flashcards
7 cards from real CCM practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Third-Party and Vendor Compliance Management flashcards as text
A key vendor notifies your organization of a data breach affecting customer records it was processing on your behalf. What is the compliance manager's first priority?
Answer: Assess the scope of the breach, activate the incident response plan, and fulfill regulatory notification obligations
A vendor data breach is an organizational incident requiring immediate scope assessment, incident response activation, and compliance with regulatory breach notification timelines (e.g., 72 hours under GDPR).
What is 'inherent risk' in the context of third-party risk assessments?
Answer: The risk a vendor poses before considering any mitigating controls
Inherent risk is the level of risk a vendor relationship poses based solely on its nature and characteristics, before any controls, contractual protections, or mitigation measures are factored in.
Which of the following best describes a 'vendor exit strategy' in compliance program management?
Answer: A documented plan for transitioning services away from a vendor with minimal disruption if the relationship must be terminated
A vendor exit strategy is a documented contingency plan that ensures the organization can smoothly transition critical services to another provider if a vendor relationship ends due to non-compliance, insolvency, or other reasons.
An organization discovers that its primary vendor has been using an unapproved subcontractor to handle sensitive data. What compliance principle does this most directly violate?
Answer: The requirement for prior written consent before subcontracting data processing activities
Most data protection frameworks and vendor contracts require explicit written approval before a vendor may subcontract data processing, ensuring the organization maintains control and oversight of the full data handling chain.
Which ISO standard provides internationally recognized guidance for managing information security risks within the supply chain and third-party relationships?
Answer: ISO 27036
ISO 27036 specifically addresses information security for supplier relationships, providing guidelines for managing information security risks across the supply chain and with third-party service providers.
What is the most important metric to demonstrate the effectiveness of a third-party compliance monitoring program to senior leadership?
Answer: Percentage of high-risk vendors with completed and current risk assessments
Tracking the percentage of high-risk vendors with current risk assessments directly measures whether the organization is fulfilling its risk-based monitoring obligations and where gaps in oversight exist.
When a compliance manager identifies that a vendor is operating in a jurisdiction with a high Transparency International Corruption Perceptions Index (CPI) score (i.e., low corruption), how should this affect the due diligence approach?
Answer: Due diligence requirements can be streamlined as lower corruption risk reduces the FCPA/anti-bribery exposure for that relationship
A high CPI score (indicating low corruption) is a mitigating factor that can support a streamlined due diligence approach for that jurisdiction, as the FCPA and anti-bribery exposure is correspondingly lower.