CORES Vendor & Third-Party Risk Oversight 5

Question 1

Which document formally defines the agreed-upon performance standards, uptime guarantees, and remedies for a vendor relationship?

Accepted Answer

Service Level Agreement (SLA)

Answer

The SLA specifies measurable performance metrics, availability targets, and contractual remedies when those standards are not met.

Question 2

A vendor that handles sensitive health insurance data for a financial institution experiences a data breach. Under HIPAA, who bears primary responsibility for notifying affected individuals?

Accepted Answer

The financial institution as the Covered Entity bears primary notification responsibility, though the Business Associate must also notify the Covered Entity promptly

Answer

Under HIPAA, the Covered Entity is responsible for notifying affected individuals; the Business Associate must notify the Covered Entity within 60 days of discovering the breach.

Question 3

What does 'inherent risk' mean in the context of a vendor risk assessment?

Accepted Answer

The risk level that exists based on the nature of the vendor relationship before considering any controls

Answer

Inherent risk reflects the baseline exposure from a vendor relationship based on factors like data access and criticality, before controls are factored in.

Question 4

Which of the following BEST represents a leading practice for managing geographic concentration risk in a vendor portfolio?

Accepted Answer

Diversifying critical vendors across multiple geographic regions and requiring multi-region data backup from cloud vendors

Answer

Geographic diversification across vendors and requiring vendors to maintain multi-region resilience protects against regional disruptions such as natural disasters or political instability.

Question 5

Which contractual provision MOST directly protects an organization if a vendor becomes insolvent?

Accepted Answer

Software escrow arrangement for source code or data custody

Answer

Escrow arrangements ensure that critical software, code, or data can be accessed by the client if the vendor ceases operations, preserving business continuity.

(CORES) Certified Operational Risk Executive Specialist Practice Test

(CORES) Certified Operational Risk Executive Specialist Practice Test

CORES Vendor & Third-Party Risk Oversight 5