CCO Third-Party and Vendor Compliance 2

Question 1

What does 'inherent risk' mean in the context of third-party vendor risk assessment?

Accepted Answer

The level of risk present before any mitigating controls are considered

Answer

Inherent risk is the gross or unmitigated risk that a vendor relationship poses before any controls, contractual protections, or monitoring activities are applied.

Question 2

Under the OCC's guidance on third-party risk management, which of the following is considered a 'critical activity' requiring heightened oversight?

Accepted Answer

Outsourcing core banking processes or functions that could harm customers if disrupted

Answer

The OCC defines critical activities as those that could cause significant customer harm, reputational damage, or safety and soundness concerns if the third party fails to perform, requiring enhanced due diligence.

Question 3

A company's vendor code of conduct should primarily do which of the following?

Accepted Answer

Communicate the organization's compliance expectations to all vendors and require written acknowledgment

Answer

A vendor code of conduct formally communicates the compliance, ethical, and legal standards the organization expects from its vendors and typically requires vendors to sign an acknowledgment of these requirements.

Question 4

What is 'vendor concentration risk' in a third-party compliance program?

Accepted Answer

The risk arising when too many critical functions depend on a single vendor, creating a single point of failure

Answer

Vendor concentration risk occurs when an organization relies too heavily on a single third party for critical functions, so any disruption to that vendor can cripple the organization's operations and compliance posture.

Question 5

Which of the following is a key indicator that a third-party vendor's compliance program is inadequate?

Accepted Answer

The vendor is unable to provide documentation of its compliance policies, training records, or audit results

Answer

An inability to produce compliance documentation is a red flag that the vendor's program exists only on paper or not at all, signaling significant risk to the contracting organization.

CCO - Chief Compliance Officer Practice Test

CCO - Chief Compliance Officer Practice Test

CCO Third-Party and Vendor Compliance 2