CRA Third-Party and Vendor Risk Management 2

Question 1

Which of the following items is typically included in a vendor due diligence questionnaire (DDQ)?

Accepted Answer

Information on security controls, financial stability, and regulatory compliance posture

Answer

Vendor's marketing strategy and customer acquisition costs

Answer

Details about the vendor's executive compensation and bonus structure

Answer

The vendor's historical stock price and analyst ratings

Question 2

What is the recommended review frequency for high-risk vendor relationships according to leading TPRM practices?

Accepted Answer

At least annually, with more frequent reviews based on elevated risk or material changes

Answer

Once at contract inception and never again unless problems arise

Answer

Every five years aligned with standard contract renewal cycles

Answer

Only when a regulatory examination or security incident occurs

Question 3

Which certification is most commonly accepted as evidence of a vendor's information security controls effectiveness over time?

Accepted Answer

SOC 2 Type II examination report

Answer

ISO 9001 Quality Management certification

Answer

PCI DSS Level 4 self-assessment questionnaire

Answer

GDPR Article 42 certification

Question 4

What does 'inherent risk' represent in a third-party risk assessment?

Accepted Answer

The level of risk that exists before any controls or mitigations are in place

Answer

The risk remaining after all controls and mitigations are fully applied

Answer

The risk formally transferred to the vendor through contractual indemnification

Answer

The risk identified exclusively during the vendor onboarding phase

Question 5

What is the primary purpose of an exit strategy in third-party risk management?

Accepted Answer

To ensure the smooth and orderly transition of services if a vendor relationship must be terminated

Answer

To negotiate lower contract prices at the time of renewal

Answer

To immediately replace vendors who fail any security audit

Answer

To document a vendor's decision to exit a particular service market

Question 6

Which U.S. regulatory guidance specifically requires financial institutions to conduct comprehensive due diligence on critical third-party service providers?

Accepted Answer

OCC Bulletin 2013-29 on Third-Party Relationships

Answer

GDPR Article 28 on data processor requirements

Answer

HIPAA Privacy Rule vendor provisions

Answer

SOX Section 302 certification requirements

Question 7

What is a vendor onboarding risk assessment primarily concerned with evaluating?

Accepted Answer

Whether a prospective vendor meets the organization's risk threshold criteria before engagement begins

Answer

The vendor's pricing competitiveness relative to market benchmarks

Answer

Whether the vendor can process electronic payments and invoices efficiently

Answer

The vendor's customer satisfaction scores and public reputation ratings