CCO Third-Party and Vendor Compliance 1 — Questions and Answers
Question 1: Which phase of the third-party lifecycle is most critical for identifying compliance risks before a vendor relationship begins?
- Contract negotiation
- Due diligence and onboarding (Correct answer)
- Ongoing monitoring
- Offboarding and termination
Correct answer: Due diligence and onboarding
Due diligence during onboarding is the most critical phase because it identifies compliance, legal, and reputational risks before the organization is exposed through the relationship.
Question 2: A CCO discovers that a third-party vendor has been convicted of bribery in a foreign jurisdiction. Under the Foreign Corrupt Practices Act (FCPA), what is the primary concern for the organization?
- The vendor's contract must be renegotiated immediately
- The organization may be held liable for the vendor's corrupt acts performed on its behalf (Correct answer)
- The organization must report the vendor to the SEC within 30 days
- Only the vendor's executives face FCPA liability
Correct answer: The organization may be held liable for the vendor's corrupt acts performed on its behalf
The FCPA extends liability to companies for corrupt acts committed by third parties acting on their behalf, making thorough vendor vetting essential.
Question 3: What is the primary purpose of a vendor risk tiering system in a compliance program?
- To rank vendors by annual contract value for budget planning
- To allocate oversight resources proportionally based on the risk each vendor poses (Correct answer)
- To determine which vendors qualify for most-favored-nation pricing
- To schedule vendor audits in alphabetical order
Correct answer: To allocate oversight resources proportionally based on the risk each vendor poses
Risk tiering allows a compliance program to focus its limited oversight resources on vendors that pose the greatest potential harm, making the program more efficient and effective.
Question 4: Which element is typically included in a vendor contract's compliance addendum?
- Guaranteed profit margins for the vendor
- Audit rights allowing the organization to inspect the vendor's compliance records (Correct answer)
- Exclusivity clauses preventing the vendor from serving competitors
- Indemnification solely in favor of the vendor
Correct answer: Audit rights allowing the organization to inspect the vendor's compliance records
Audit rights in compliance addenda give organizations the ability to verify that vendors are meeting their contractual and regulatory obligations.
Question 5: When a vendor operates as a 'fourth party' (a subcontractor to your direct vendor), what is the organization's best practice?
- Ignore fourth parties since there is no direct contractual relationship
- Require direct vendors to flow down compliance obligations and monitor their subcontractors (Correct answer)
- Conduct the same level of due diligence on fourth parties as on direct employees
- Report all fourth parties to the relevant regulatory authority
Correct answer: Require direct vendors to flow down compliance obligations and monitor their subcontractors
Organizations manage fourth-party risk by requiring direct vendors to impose equivalent compliance requirements on their subcontractors and to monitor compliance accordingly.
Question 6: A CCO learns that a key supplier is experiencing severe financial distress. From a compliance perspective, what is the primary risk?
- The supplier may increase prices, affecting the organization's margins
- The supplier may cut corners on compliance controls, increasing regulatory and reputational risk (Correct answer)
- The supplier may hire away your compliance staff
- Financial distress automatically voids the compliance terms of the contract
Correct answer: The supplier may cut corners on compliance controls, increasing regulatory and reputational risk
Financially distressed vendors often reduce compliance spending as a cost-cutting measure, which can lead to regulatory violations, data breaches, or other compliance failures that expose the contracting organization.
Question 7: Which regulatory framework specifically requires financial institutions to conduct due diligence on third-party vendors who handle sensitive customer data?
- Sarbanes-Oxley Act (SOX)
- Gramm-Leach-Bliley Act (GLBA) (Correct answer)
- Sherman Antitrust Act
- Robinson-Patman Act
Correct answer: Gramm-Leach-Bliley Act (GLBA)
The GLBA requires financial institutions to have programs ensuring customer financial information remains protected even when shared with or processed by third-party service providers.
CCO Third-Party and Vendor Compliance 1
Which phase of the third-party lifecycle is most critical for identifying compliance risks before a vendor relationship begins?