CCO Third-Party and Vendor Compliance 3

Question 1

When offboarding a vendor who handled sensitive personal data, what is the compliance officer's primary obligation?

Accepted Answer

Verify that the vendor has returned or securely destroyed all personal data per contractual and regulatory requirements

Answer

Data destruction or return upon offboarding is a critical regulatory and contractual requirement under frameworks like GDPR and CCPA to prevent unauthorized retention or use of personal data by former vendors.

Question 2

Which due diligence tool is most effective for screening third-party vendors against global sanctions lists and politically exposed persons (PEPs)?

Accepted Answer

An automated screening solution integrated with OFAC, UN, and other global watchlists

Answer

Automated screening tools that continuously check vendors against OFAC, EU, UN, and other sanctions and PEP lists provide the most reliable and scalable compliance coverage for anti-money laundering and sanctions obligations.

Question 3

A vendor notifies your organization of a data breach affecting data it processes on your behalf. Under GDPR, who bears primary accountability to the affected data subjects?

Accepted Answer

The organization (data controller), which remains accountable to data subjects for how their data was processed

Answer

Under GDPR, the data controller retains accountability to data subjects regardless of delegation to a processor; the organization must notify supervisory authorities and affected individuals within required timeframes.

Question 4

What does a vendor's SOC 2 Type II report assess?

Accepted Answer

The effectiveness of the vendor's controls related to security, availability, and confidentiality over a defined operating period

Answer

A SOC 2 Type II report evaluates whether a service organization's controls related to the Trust Service Criteria (security, availability, processing integrity, confidentiality, privacy) were operating effectively over a review period.

Question 5

In third-party compliance management, what is the significance of 'residual risk'?

Accepted Answer

It is the risk that remains after all mitigating controls and contractual protections have been applied

Answer

Residual risk is what the organization accepts after controls are in place; if residual risk exceeds the organization's risk appetite, additional controls or relationship termination may be required.

CCO - Chief Compliance Officer Practice Test

CCO - Chief Compliance Officer Practice Test

CCO Third-Party and Vendor Compliance 3