CORES Vendor & Third-Party Risk Oversight 4

Question 1

A vendor serving a community bank is acquired by a foreign company in a country with weak data privacy laws. What is the MOST significant risk this creates?

Accepted Answer

Data sovereignty and regulatory compliance risk due to potential foreign government access to customer data

Answer

Foreign acquisitions can expose customer data to the jurisdiction of countries with weaker privacy protections or government surveillance powers, creating regulatory and reputational risk.

Question 2

What distinguishes a 'critical vendor' from a 'non-critical vendor' in most TPRM frameworks?

Accepted Answer

Critical vendors provide services whose disruption would materially impact the organization's operations, revenue, or compliance posture

Answer

Criticality is defined by the impact of service disruption, not by vendor size, contract length, or historical performance.

Question 3

Which regulatory body issued the 'Guidance on Managing Outsourcing Risk' that directly governs how U.S. banks oversee third-party arrangements?

Accepted Answer

Office of the Comptroller of the Currency (OCC)

Answer

The OCC has issued specific guidance on third-party risk management that applies to national banks and federal savings associations.

Question 4

An organization's vendor risk committee is reviewing a high-risk vendor that has consistently failed to remediate identified control gaps. What is the MOST appropriate escalation action?

Accepted Answer

Escalate to senior leadership and consider compensating controls, enhanced monitoring, or contract termination

Answer

Persistent control failures by a high-risk vendor require escalation to leadership and consideration of corrective actions up to and including termination.

Question 5

What is a key limitation of relying solely on vendor-provided self-assessment questionnaires (SAQs) for risk evaluation?

Accepted Answer

SAQs depend entirely on vendor honesty and may not reflect actual control effectiveness

Answer

Because SAQs are self-reported, they are subject to misrepresentation or misunderstanding, and must be supplemented with independent validation to be reliable.

(CORES) Certified Operational Risk Executive Specialist Practice Test

(CORES) Certified Operational Risk Executive Specialist Practice Test

CORES Vendor & Third-Party Risk Oversight 4