CRA Third-Party and Vendor Risk Management 2

Question 1

Which of the following items is typically included in a vendor due diligence questionnaire (DDQ)?

Accepted Answer

Information on security controls, financial stability, and regulatory compliance posture

Answer

DDQs gather information on security practices, financial health, and compliance posture to comprehensively assess the risks a vendor introduces.

Question 2

What is the recommended review frequency for high-risk vendor relationships according to leading TPRM practices?

Accepted Answer

At least annually, with more frequent reviews based on elevated risk or material changes

Answer

High-risk vendor relationships require at least annual reviews, with increased frequency triggered by changes in the vendor's risk profile, ownership, or operational circumstances.

Question 3

Which certification is most commonly accepted as evidence of a vendor's information security controls effectiveness over time?

Accepted Answer

SOC 2 Type II examination report

Answer

SOC 2 Type II reports provide evidence that a vendor's security, availability, and confidentiality controls operated effectively over a defined reporting period.

Question 4

What does 'inherent risk' represent in a third-party risk assessment?

Accepted Answer

The level of risk that exists before any controls or mitigations are in place

Answer

Inherent risk is the baseline level of risk present before any controls, mitigations, or countermeasures are considered or applied.

Question 5

What is the primary purpose of an exit strategy in third-party risk management?

Accepted Answer

To ensure the smooth and orderly transition of services if a vendor relationship must be terminated

Answer

Exit strategies protect business continuity by planning for the orderly transition of services and data in the event a vendor relationship must unexpectedly end.

(CRA) Certified Risk Architect Practice Test

(CRA) Certified Risk Architect Practice Test

CRA Third-Party and Vendor Risk Management 2