CORES Vendor & Third-Party Risk Oversight 3

Question 1

An organization's TPRM policy requires annual reassessment of all vendors. A critical vendor has undergone a significant merger mid-year. What action should the risk team take?

Accepted Answer

Trigger an out-of-cycle risk reassessment due to the material change in the vendor's profile

Answer

Material changes such as mergers represent trigger events that warrant immediate reassessment regardless of the regular review schedule.

Question 2

Which element is MOST critical when reviewing a vendor's business continuity plan (BCP) during due diligence?

Accepted Answer

Whether the BCP has been tested and includes recovery time objectives aligned with your own RTOs

Answer

A BCP is only credible if it has been tested and its recovery objectives are compatible with the client organization's own continuity requirements.

Question 3

What is the primary purpose of including a 'right to audit' clause in a vendor contract?

Accepted Answer

To grant the organization the ability to independently verify vendor compliance and control effectiveness

Answer

Right-to-audit clauses preserve the client's ability to independently verify that the vendor is meeting contractual and regulatory obligations.

Question 4

A vendor that processes payroll for your organization suffers a ransomware attack. Under a sound third-party incident response protocol, what should your organization do FIRST?

Accepted Answer

Activate your incident response plan, contact the vendor for status, and assess impact on your operations

Answer

Activating your own incident response plan and gathering vendor status information is the first step to assessing and managing the impact on your organization.

Question 5

Which risk tier classification approach is MOST consistent with regulatory expectations for prioritizing vendor oversight resources?

Accepted Answer

Risk-based tiering that considers criticality of service, data sensitivity, and substitutability

Answer

Regulators expect a risk-based approach that allocates oversight intensity based on the actual risk profile of each vendor relationship.

(CORES) Certified Operational Risk Executive Specialist Practice Test

(CORES) Certified Operational Risk Executive Specialist Practice Test

CORES Vendor & Third-Party Risk Oversight 3