CRA Third-Party and Vendor Risk Management

Question 1

What is the primary purpose of a third-party risk management (TPRM) program?

Accepted Answer

To identify, assess, and mitigate risks introduced by external vendors and service providers

Answer

TPRM programs are designed to systematically identify, assess, and manage risks that arise from relationships with external vendors and service providers.

Question 2

Which of the following best describes 'fourth-party risk' in vendor risk management?

Accepted Answer

Risk posed by the subcontractors or suppliers used by your direct vendors

Answer

Fourth-party risk refers to risks posed by the subcontractors or suppliers of your direct (third-party) vendors, extending risk visibility beyond direct relationships.

Question 3

What is vendor tiering classification primarily used for in a TPRM program?

Accepted Answer

Determining the appropriate level of due diligence and oversight based on risk exposure

Answer

Vendor tiering helps organizations apply proportionate due diligence and oversight, directing the most rigorous scrutiny toward vendors that present the greatest risk.

Question 4

What is the purpose of a right-to-audit clause in a vendor contract?

Accepted Answer

To permit the organization to inspect vendor operations and verify compliance with contractual obligations

Answer

A right-to-audit clause grants the contracting organization authority to inspect and verify a vendor's controls, processes, and compliance with agreed-upon obligations.

Question 5

Which risk category is most directly associated with a critical vendor experiencing financial insolvency?

Accepted Answer

Vendor exit and service continuity risk

Answer

Vendor insolvency creates exit and continuity risk because it threatens the ongoing delivery of critical services or products that the organization depends on.

(CRA) Certified Risk Architect Practice Test

(CRA) Certified Risk Architect Practice Test

CRA Third-Party and Vendor Risk Management