Third-Party and Vendor Compliance Management Flashcards
7 cards from real CCM practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Third-Party and Vendor Compliance Management flashcards as text
A vendor experiences a data breach affecting your organization's customer records. Under a robust third-party contract, what obligation should the vendor have?
Answer: Notify the organization within a contractually defined timeframe
Contracts should require vendors to notify the organization promptly after a breach so the organization can fulfill its own regulatory notification obligations.
Which metric is most useful for measuring the effectiveness of a third-party compliance monitoring program?
Answer: Percentage of vendors with no overdue remediation items
Tracking the percentage of vendors with no overdue remediation items directly measures how well compliance gaps are being resolved.
What is the primary purpose of including a 'right-to-audit' clause in a vendor agreement?
Answer: To give the organization the ability to verify vendor compliance with contractual obligations
A right-to-audit clause ensures the organization can independently verify that vendors are meeting their compliance and contractual commitments.
A compliance manager discovers that a critical vendor is subcontracting work to an unapproved fourth party. What is the most appropriate immediate action?
Answer: Notify internal legal and risk teams and require the vendor to cease unapproved subcontracting
Unapproved subcontracting is a contract breach requiring immediate escalation to legal and risk, and remediation by the vendor.
Under the US FFIEC guidance for financial institutions, how should third-party risk management be integrated into enterprise risk management?
Answer: As a component embedded within the institution's overall risk governance framework
FFIEC guidance requires financial institutions to incorporate third-party risk management into their broader enterprise risk governance structures.
Which of the following best describes 'inherent risk' in the context of vendor risk assessment?
Answer: Risk that exists before any controls or mitigations are considered
Inherent risk is the level of risk posed by a vendor relationship before accounting for any controls or mitigating factors.
A vendor's SOC 2 Type II report contains several exceptions noted by the auditor. How should a compliance manager interpret this?
Answer: The exceptions indicate control deficiencies that require further evaluation and possible compensating controls
Auditor exceptions in a SOC 2 Type II report signal areas where controls may not be operating effectively, warranting deeper analysis and risk mitigation.