CCM Third-Party and Vendor Compliance Management 3

Question 1

A key vendor notifies your organization of a data breach affecting customer records it was processing on your behalf. What is the compliance manager's first priority?

Accepted Answer

Assess the scope of the breach, activate the incident response plan, and fulfill regulatory notification obligations

Answer

Immediately terminate the vendor contract

Answer

Wait for law enforcement to complete their investigation before taking action

Answer

Notify the media before regulators to control the narrative

Question 2

What is 'inherent risk' in the context of third-party risk assessments?

Accepted Answer

The risk a vendor poses before considering any mitigating controls

Answer

The residual risk remaining after controls are applied

Answer

The risk that a vendor will inherit the organization's liabilities

Answer

The risk introduced by internal employees, not vendors

Question 3

Which of the following best describes a 'vendor exit strategy' in compliance program management?

Accepted Answer

A documented plan for transitioning services away from a vendor with minimal disruption if the relationship must be terminated

Answer

A plan for the vendor to exit the market and close its business

Answer

A strategy for the organization to exit all vendor relationships to reduce risk

Answer

A process for vendors to exit compliance audits early

Question 4

An organization discovers that its primary vendor has been using an unapproved subcontractor to handle sensitive data. What compliance principle does this most directly violate?

Accepted Answer

The requirement for prior written consent before subcontracting data processing activities

Answer

The principle of least privilege

Answer

The prohibition on fourth-party risk management

Answer

The principle of regulatory arbitrage

Question 5

Which ISO standard provides internationally recognized guidance for managing information security risks within the supply chain and third-party relationships?

Accepted Answer

ISO 27036

Answer

ISO 9001

Answer

ISO 14001

Answer

ISO 45001

Question 6

What is the most important metric to demonstrate the effectiveness of a third-party compliance monitoring program to senior leadership?

Accepted Answer

Percentage of high-risk vendors with completed and current risk assessments

Answer

Total number of vendors under contract

Answer

Average time to complete vendor contracts

Answer

Total dollar value of vendor spending

Question 7

When a compliance manager identifies that a vendor is operating in a jurisdiction with a high Transparency International Corruption Perceptions Index (CPI) score (i.e., low corruption), how should this affect the due diligence approach?

Accepted Answer

Due diligence requirements can be streamlined as lower corruption risk reduces the FCPA/anti-bribery exposure for that relationship

Answer

Enhanced due diligence is still required regardless of CPI score

Answer

The vendor should be classified as high risk regardless of the CPI score

Answer

Jurisdictional risk is not a factor considered in third-party compliance programs