CRISC Third-Party and Vendor Risk Management 3

Question 1

Which of the following BEST describes a vendor risk appetite statement?

Accepted Answer

A formal declaration of the level and type of third-party risk the organization is willing to accept

Answer

A description of all risks the organization wishes to transfer to vendors

Answer

A list of vendors who have been approved for all risk categories

Answer

A budget allocation for vendor risk management activities

Question 2

Continuous monitoring of third-party vendors is BEST achieved through:

Accepted Answer

Real-time threat intelligence feeds, periodic assessments, and performance metric tracking

Answer

Annual vendor questionnaires sent via email

Answer

Monthly billing reviews and invoice reconciliation

Answer

Bi-annual in-person vendor relationship meetings

Question 3

Supply chain risk management in IT focuses primarily on risks from:

Accepted Answer

Hardware manufacturers, software vendors, and service providers across the entire IT supply chain

Answer

Physical transportation of hardware components only

Answer

Internal logistics and warehouse management systems

Answer

Procurement department staffing levels

Question 4

A vendor risk scoring model should incorporate which combination of factors?

Accepted Answer

Inherent risk level, control effectiveness, and residual risk rating

Answer

Vendor age, headquarters location, and number of clients

Answer

Contract value, payment history, and vendor size

Answer

Geographic proximity, account manager tenure, and pricing model

Question 5

When a critical vendor announces it is going out of business, the organization should FIRST:

Accepted Answer

Activate contingency or exit plans and identify alternative vendors

Answer

Immediately notify regulators without assessing impact

Answer

Wait to see if the vendor finds a buyer before taking action

Answer

Stop all payments to the vendor immediately

Question 6

Which standard provides a framework specifically for information security requirements in supplier relationships?

Accepted Answer

ISO/IEC 27036 (Information Security for Supplier Relationships)

Answer

ISO 14001 (Environmental Management)

Answer

ISO 45001 (Occupational Health and Safety)

Answer

ISO 22000 (Food Safety Management)

Question 7

What is the MAIN benefit of including a 'business continuity' requirement in vendor contracts?

Accepted Answer

It ensures the vendor has tested plans to maintain services during disruptions affecting your organization

Answer

It reduces the contract price by sharing risk with the vendor

Answer

It transfers all continuity responsibility to the vendor

Answer

It eliminates the need for the organization to maintain its own BCP