CORES Vendor & Third-Party Risk Oversight 2

Question 1

A bank discovers that a critical payment processor subcontracted data handling to a fourth-party provider without prior notification. What is the MOST appropriate immediate response?

Accepted Answer

Invoke the contract clause requiring prior approval for subcontracting and conduct a risk assessment of the fourth party

Answer

Contract clauses requiring notification and approval for subcontracting are the mechanism to enforce fourth-party visibility; invoking them and assessing the risk is the appropriate first step.

Question 2

Which metric is MOST useful for measuring the effectiveness of a vendor risk management program over time?

Accepted Answer

Percentage of vendors with completed and current risk assessments

Answer

Tracking the percentage of vendors with current risk assessments directly reflects program coverage and discipline.

Question 3

A vendor's SOC 2 Type II report reveals several exceptions in access control user provisioning. What does this finding most directly indicate?

Accepted Answer

Controls related to logical access may not be operating effectively throughout the audit period

Answer

SOC 2 Type II exceptions indicate that a stated control did not operate as designed during the period covered by the report.

Question 4

Under the OCC's third-party risk management guidance, which vendors typically require the MOST rigorous due diligence?

Accepted Answer

Vendors involved in critical activities or handling sensitive customer data

Answer

OCC guidance directs heightened scrutiny toward vendors supporting critical activities or accessing sensitive data due to the elevated risk they pose.

Question 5

What is 'concentration risk' in the context of third-party vendor management?

Accepted Answer

The risk arising from over-reliance on a single vendor or a small group of vendors for critical services

Answer

Concentration risk occurs when an organization depends heavily on one or few vendors, creating systemic vulnerability if that vendor fails.

(CORES) Certified Operational Risk Executive Specialist Practice Test

(CORES) Certified Operational Risk Executive Specialist Practice Test

CORES Vendor & Third-Party Risk Oversight 2