CCM Third-Party and Vendor Compliance Management

Question 1

What is the primary purpose of conducting due diligence on a third-party vendor before onboarding?

Accepted Answer

To assess the vendor's compliance risks and alignment with organizational standards

Answer

To negotiate lower contract prices

Answer

To determine the vendor's market share

Answer

To verify the vendor's employee headcount

Question 2

Which contractual clause gives a company the legal right to examine a vendor's books, records, and operations to verify compliance?

Accepted Answer

Right-to-audit clause

Answer

Force majeure clause

Answer

Indemnification clause

Answer

Liquidated damages clause

Question 3

What is 'fourth-party risk' in a third-party risk management program?

Accepted Answer

Risk introduced by the subcontractors and service providers used by your direct vendors

Answer

Risk arising from a company's fourth-largest vendor by spend

Answer

Risk from four simultaneous vendor failures

Answer

Risk associated with the fourth year of a vendor contract

Question 4

When categorizing vendors by risk level, which factor most strongly suggests a vendor should be classified as HIGH risk?

Accepted Answer

The vendor has access to sensitive customer data and operates in a high-corruption jurisdiction

Answer

The vendor has been in business for fewer than five years

Answer

The vendor is located in a different time zone

Answer

The vendor provides general office supplies

Question 5

A vendor's compliance questionnaire response reveals it has no documented information security policy. What is the compliance manager's most appropriate immediate action?

Accepted Answer

Document the finding, request a remediation plan with timeline, and escalate if unresolved

Answer

Terminate the vendor relationship immediately without further review

Answer

Ignore the gap if the vendor's pricing is competitive

Answer

Transfer all risk to the vendor by adding a disclaimer to the contract

Question 6

Which regulatory guidance specifically requires financial institutions to have a robust third-party risk management program covering due diligence, contract management, and ongoing monitoring?

Accepted Answer

OCC Guidance 2013-29 on Third-Party Relationships

Answer

SEC Regulation S-K

Answer

COSO Internal Control Framework

Answer

FINRA Rule 4370

Question 7

What is the most effective approach to managing compliance risk when a critical vendor is acquired by a competitor?

Accepted Answer

Conduct a reassessment of the vendor's compliance posture and renegotiate contract terms as needed

Answer

Continue the relationship unchanged since the contract is still valid

Answer

Immediately terminate the contract without review

Answer

Wait for the next scheduled review cycle to address any changes