CCO Third-Party and Vendor Compliance 2

Question 1

What does 'inherent risk' mean in the context of third-party vendor risk assessment?

Accepted Answer

The level of risk present before any mitigating controls are considered

Answer

The risk that remains after all controls are applied

Answer

The risk transferred to the vendor through contract terms

Answer

The financial risk of vendor non-performance

Question 2

Under the OCC's guidance on third-party risk management, which of the following is considered a 'critical activity' requiring heightened oversight?

Accepted Answer

Outsourcing core banking processes or functions that could harm customers if disrupted

Answer

Purchasing office supplies from an approved vendor

Answer

Engaging a one-time consultant for a training seminar

Answer

Using a standard cloud storage provider for non-sensitive files

Question 3

A company's vendor code of conduct should primarily do which of the following?

Accepted Answer

Communicate the organization's compliance expectations to all vendors and require written acknowledgment

Answer

Set pricing benchmarks for vendor negotiations

Answer

Replace the need for individual vendor contracts

Answer

Guarantee vendor performance against SLAs

Question 4

What is 'vendor concentration risk' in a third-party compliance program?

Accepted Answer

The risk arising when too many critical functions depend on a single vendor, creating a single point of failure

Answer

The risk that a vendor's workforce is too concentrated in one geographic area

Answer

The risk that vendor pricing is concentrated among high-cost providers

Answer

The risk that one vendor supplies competing firms

Question 5

Which of the following is a key indicator that a third-party vendor's compliance program is inadequate?

Accepted Answer

The vendor is unable to provide documentation of its compliance policies, training records, or audit results

Answer

The vendor has fewer compliance staff than the hiring organization

Answer

The vendor's compliance program mirrors the organization's own program exactly

Answer

The vendor's compliance officer has less tenure than the organization's CCO

Question 6

In the context of anti-bribery compliance, what is a 'red flag' that should heighten scrutiny of a third-party intermediary?

Accepted Answer

The intermediary requests unusual payment structures such as cash payments or payments to a third country

Answer

The intermediary operates in multiple countries simultaneously

Answer

The intermediary has staff who previously worked at a competitor

Answer

The intermediary charges standard market rates for its services

Question 7

What is the purpose of a 'right to audit' clause in a vendor contract?

Accepted Answer

To give the organization the contractual right to review and inspect the vendor's compliance-related records and processes

Answer

To allow the vendor to audit the organization's financial records

Answer

To permit the vendor to audit competitors on the organization's behalf

Answer

To satisfy accounting standards for revenue recognition