CCM Third-Party and Vendor Compliance Management 2

Question 1

What is 'vendor tiering' in the context of third-party risk management?

Accepted Answer

Classifying vendors into risk levels to allocate due diligence and monitoring resources proportionally

Answer

Vendor tiering assigns risk levels (e.g., critical, high, medium, low) based on factors such as data access, regulatory impact, and financial exposure, enabling the organization to focus compliance resources where risk is greatest.

Question 2

Which of the following is a significant red flag during third-party due diligence that should trigger enhanced scrutiny?

Accepted Answer

The vendor declines to disclose ownership structure or beneficial owners

Answer

Refusal to disclose ownership or beneficial owners raises anti-money laundering, sanctions, and corruption concerns, and is a classic red flag requiring enhanced due diligence.

Question 3

What key element must be included in a vendor contract to support ongoing compliance oversight?

Accepted Answer

Compliance obligations, reporting requirements, and rights to terminate for non-compliance

Answer

Effective vendor contracts must specify the compliance standards the vendor must meet, how they must report compliance issues, and the organization's right to terminate if those standards are not upheld.

Question 4

How frequently should a compliance manager reassess a high-risk critical vendor relationship?

Accepted Answer

At least annually, and upon any material change

Answer

High-risk vendors require at least annual reassessment, plus reviews triggered by material events such as data breaches, ownership changes, or regulatory actions, to ensure ongoing compliance alignment.

Question 5

What is the primary purpose of a vendor code of conduct?

Accepted Answer

To define ethical and legal behavior standards that vendors must follow to do business with the organization

Answer

A vendor code of conduct communicates the ethical, legal, and compliance standards the organization expects all vendors to uphold, extending the organization's compliance culture to its supply chain.

(CCM) Certified Compliance Manager Practice Test

(CCM) Certified Compliance Manager Practice Test

CCM Third-Party and Vendor Compliance Management 2