CRISC Third-Party and Vendor Risk Management 2

Question 1

Concentration risk in third-party management occurs when:

Accepted Answer

A single vendor provides services to multiple business units or critical functions

Answer

Concentration risk arises when over-reliance on a single vendor means their failure could simultaneously disrupt multiple critical organizational functions.

Question 2

Under the shared responsibility model for cloud services, who is responsible for classifying and protecting customer data stored in the cloud?

Accepted Answer

The customer organization

Answer

Under the shared responsibility model, the customer organization retains responsibility for data classification, access control, and data protection even when data resides in the cloud.

Question 3

What is the BEST approach for managing vendor risk when a vendor refuses to allow direct audits?

Accepted Answer

Require the vendor to provide third-party audit reports such as SOC 2 Type II

Answer

Independent third-party audit reports like SOC 2 Type II provide objective assurance of vendor control effectiveness when direct audits are not permitted.

Question 4

A vendor risk register should PRIMARILY contain:

Accepted Answer

Identified risks associated with each vendor, their likelihood, impact, and mitigating controls

Answer

A vendor risk register documents risks per vendor alongside risk ratings and controls, enabling systematic tracking and management of third-party risk exposure.

Question 5

Which regulatory framework explicitly requires organizations to assess and manage third-party risks for financial institutions?

Accepted Answer

FFIEC IT Examination Handbook (Third-Party Relationships)

Answer

The FFIEC IT Examination Handbook on Third-Party Relationships provides specific regulatory guidance for financial institutions on managing vendor and third-party risks.

CRISC - Certified in Risk and Information Systems Control Practice Test

CRISC - Certified in Risk and Information Systems Control Practice Test

CRISC Third-Party and Vendor Risk Management 2