CRA Third-Party and Vendor Risk Management 3

Question 1

What is the primary purpose of a vendor scorecard in ongoing vendor relationship management?

Accepted Answer

To continuously measure vendor performance against defined KPIs and risk metrics

Answer

To rank vendors for co-marketing and partnership opportunities

Answer

To determine vendor payment priority during organizational budget constraints

Answer

To benchmark vendors against competitors in the open marketplace

Question 2

Which strategy best mitigates the risk of vendor lock-in for a critical service?

Accepted Answer

Diversifying the vendor portfolio and ensuring data portability and interoperability

Answer

Signing longer-term contracts to secure favorable pricing arrangements

Answer

Designating a single preferred vendor per service category to streamline management

Answer

Avoiding customization of vendor products to maintain standardized interfaces

Question 3

How should an organization respond when a critical vendor notifies it of a significant data breach?

Accepted Answer

Activate the incident response plan, assess the impact on the organization, and coordinate remediation with the vendor

Answer

Immediately terminate the vendor contract without further investigation

Answer

Wait for the vendor to independently resolve the breach before taking any internal action

Answer

Notify only senior IT leadership and delay external stakeholder communication indefinitely

Question 4

What does 'residual risk' represent after vendor controls and mitigations have been applied?

Accepted Answer

The level of risk that remains after all identified controls and mitigations have been applied

Answer

The total risk that existed before any controls were implemented

Answer

The portion of risk formally assumed by the vendor under contractual indemnification

Answer

The risk that has been transferred entirely to insurance carriers

Question 5

Which practice is considered a best approach for managing geographic concentration risk in the vendor portfolio?

Accepted Answer

Distributing critical vendor relationships across multiple geographic regions to reduce regional exposure

Answer

Requiring all critical vendors to be headquartered in the same regulatory jurisdiction

Answer

Selecting vendors exclusively from the lowest-cost labor markets to optimize efficiency

Answer

Centralizing all vendor-delivered operations in a single shared data center

Question 6

What is the role of 'vendor risk appetite' in a TPRM program?

Accepted Answer

It establishes the level of third-party risk the organization is willing to accept in pursuit of its objectives

Answer

It defines the maximum number of vendors the organization is permitted to engage at one time

Answer

It determines the minimum contract value threshold required for formal vendor engagement

Answer

It specifies the categories of products and services vendors are approved to provide

Question 7

Which of the following represents the most significant challenge in managing nth-party (extended supply chain) risk?

Accepted Answer

Limited visibility into the risk controls and practices of sub-vendors beyond direct vendor relationships

Answer

The difficulty in identifying and onboarding first-tier direct vendors

Answer

Excessive documentation requirements imposed by primary vendor contracts

Answer

The high licensing cost of vendor management and SLA monitoring software tools