Third-Party and Vendor Compliance Management Flashcards
7 cards from real CCM practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Third-Party and Vendor Compliance Management flashcards as text
What is the key difference between vendor offboarding and contract termination from a compliance perspective?
Answer: Offboarding includes data return/destruction and access revocation, while termination is only the legal end of the contract
Offboarding encompasses the operational steps—such as data return, destruction, and system access removal—that must occur alongside or after legal termination.
A compliance program requires vendors to complete annual self-attestation questionnaires. What is the main limitation of relying solely on this approach?
Answer: Vendors may provide inaccurate or optimistic responses without independent verification
Self-attestations depend on vendor honesty and competence; without independent verification, compliance gaps may go undetected.
When assessing a vendor that processes protected health information (PHI), which US regulation primarily governs the required contractual safeguards?
Answer: Health Insurance Portability and Accountability Act (HIPAA) Business Associate Agreement requirements
HIPAA requires covered entities to execute Business Associate Agreements (BAAs) with vendors that access, use, or disclose PHI on their behalf.
Which scenario represents an example of 'concentration risk' in third-party management?
Answer: Relying on a single vendor for multiple critical services across the organization
Concentration risk arises when an organization is overly dependent on one vendor, making any disruption to that vendor disproportionately impactful.
What role does a vendor compliance scorecard serve in an ongoing monitoring program?
Answer: It provides a structured, consistent way to track and compare vendor performance against compliance criteria over time
A vendor compliance scorecard enables objective, repeatable measurement of vendor performance, supporting trend analysis and informed risk decisions.
A vendor operating in a foreign jurisdiction has different data privacy standards than those required by US law. What is the compliance manager's best course of action?
Answer: Require the vendor to contractually commit to meeting US regulatory requirements regardless of local law
Contracts should explicitly require vendors to meet the organization's applicable regulatory standards, even when operating under less stringent local laws.
Which of the following is a leading practice when conducting due diligence on a prospective vendor that will access sensitive financial data?
Answer: Assessing the vendor's financial stability, security posture, regulatory history, and control environment before contract execution
Comprehensive pre-contract due diligence covering financial health, security, regulatory standing, and controls is essential before engaging a vendor with access to sensitive data.