CRA Third-Party and Vendor Risk Management

Question 1

What is the primary purpose of a third-party risk management (TPRM) program?

Accepted Answer

To identify, assess, and mitigate risks introduced by external vendors and service providers

Answer

To eliminate all vendor relationships that pose any potential risk

Answer

To transfer all operational responsibilities to third-party providers

Answer

To ensure all vendors use the same technology platforms

Question 2

Which of the following best describes 'fourth-party risk' in vendor risk management?

Accepted Answer

Risk posed by the subcontractors or suppliers used by your direct vendors

Answer

Risk from vendors who have not been directly contracted

Answer

Risk arising from four separate vendor failure categories

Answer

Risk from vendors operating across four different countries

Question 3

What is vendor tiering classification primarily used for in a TPRM program?

Accepted Answer

Determining the appropriate level of due diligence and oversight based on risk exposure

Answer

Ranking vendors by revenue generated for the organization

Answer

Sorting vendors alphabetically for contract management purposes

Answer

Classifying vendors by geographic headquarters location

Question 4

What is the purpose of a right-to-audit clause in a vendor contract?

Accepted Answer

To permit the organization to inspect vendor operations and verify compliance with contractual obligations

Answer

To allow the vendor to audit the organization's financial records

Answer

To authorize independent third-party auditors to review both parties equally

Answer

To enable regulatory bodies to directly examine vendor compliance on demand

Question 5

Which risk category is most directly associated with a critical vendor experiencing financial insolvency?

Accepted Answer

Vendor exit and service continuity risk

Answer

Reputational risk from public disclosure

Answer

Concentration risk from portfolio overexposure

Answer

Compliance risk from regulatory reporting gaps

Question 6

What is a key indicator that an organization may have excessive concentration risk in its vendor portfolio?

Accepted Answer

Over-reliance on a single vendor for the delivery of critical business services

Answer

Engaging more than ten vendors within a single service category

Answer

Using vendors headquartered in more than three geographic regions

Answer

Contracting with vendors who also serve direct competitors

Question 7

In TPRM, what does the term 'vendor lifecycle management' encompass?

Accepted Answer

Overseeing vendor relationships from initial due diligence through offboarding and termination

Answer

Managing only the contract negotiation and execution phases of vendor relationships

Answer

Tracking vendor product development cycles and release schedules

Answer

Monitoring vendor financial performance from IPO through potential acquisition