CCO Third-Party and Vendor Compliance 3

Question 1

When offboarding a vendor who handled sensitive personal data, what is the compliance officer's primary obligation?

Accepted Answer

Verify that the vendor has returned or securely destroyed all personal data per contractual and regulatory requirements

Answer

Ensure the vendor provides a positive reference for future business

Answer

Transfer the vendor's employees to the organization's payroll

Answer

Notify the vendor's competitors that they may now solicit the business

Question 2

Which due diligence tool is most effective for screening third-party vendors against global sanctions lists and politically exposed persons (PEPs)?

Accepted Answer

An automated screening solution integrated with OFAC, UN, and other global watchlists

Answer

A general internet search

Answer

Reviewing the vendor's annual report

Answer

Checking the vendor's LinkedIn company page

Question 3

A vendor notifies your organization of a data breach affecting data it processes on your behalf. Under GDPR, who bears primary accountability to the affected data subjects?

Accepted Answer

The organization (data controller), which remains accountable to data subjects for how their data was processed

Answer

The vendor, as it controls the systems where the breach occurred

Answer

The cloud provider hosting the vendor's infrastructure

Answer

The national supervisory authority

Question 4

What does a vendor's SOC 2 Type II report assess?

Accepted Answer

The effectiveness of the vendor's controls related to security, availability, and confidentiality over a defined operating period

Answer

The vendor's financial solvency and credit rating

Answer

The vendor's compliance with environmental sustainability standards

Answer

The vendor's adherence to employment discrimination laws

Question 5

In third-party compliance management, what is the significance of 'residual risk'?

Accepted Answer

It is the risk that remains after all mitigating controls and contractual protections have been applied

Answer

It is the initial risk level before any controls are applied

Answer

It is the financial liability left unpaid after insurance coverage

Answer

It is the risk posed by vendors who have left the supply chain

Question 6

Which best describes the 'flow-down' requirement in third-party compliance programs?

Accepted Answer

Requiring vendors to impose the same compliance standards on their subcontractors that the organization imposes on the vendors

Answer

Requiring vendors to pass cost savings on to the organization

Answer

Requiring compliance reports to flow downward from executives to staff

Answer

Requiring regulators to share audit findings with vendors

Question 7

What is the most effective way to ensure that a third-party compliance program remains current as vendor relationships and regulations evolve?

Accepted Answer

Implement periodic re-assessments, continuous monitoring, and annual program reviews tied to regulatory changes and vendor risk changes

Answer

Conduct a one-time comprehensive vendor review at program inception

Answer

Rely exclusively on vendor self-attestations submitted at contract signing

Answer

Assign compliance responsibilities entirely to the procurement team