CRISC Third-Party and Vendor Risk Management 3

Question 1

Which of the following BEST describes a vendor risk appetite statement?

Accepted Answer

A formal declaration of the level and type of third-party risk the organization is willing to accept

Answer

A vendor risk appetite statement formally defines how much and what types of third-party risk the organization will tolerate, guiding vendor selection and management decisions.

Question 2

Continuous monitoring of third-party vendors is BEST achieved through:

Accepted Answer

Real-time threat intelligence feeds, periodic assessments, and performance metric tracking

Answer

Continuous monitoring combines real-time intelligence with periodic structured assessments to provide an up-to-date view of vendor risk posture throughout the relationship lifecycle.

Question 3

Supply chain risk management in IT focuses primarily on risks from:

Accepted Answer

Hardware manufacturers, software vendors, and service providers across the entire IT supply chain

Answer

IT supply chain risk encompasses risks from all parties in the chain of hardware, software, and services that ultimately deliver IT capabilities to the organization.

Question 4

A vendor risk scoring model should incorporate which combination of factors?

Accepted Answer

Inherent risk level, control effectiveness, and residual risk rating

Answer

Effective vendor risk scoring combines inherent risk (potential exposure) with control effectiveness to derive residual risk, enabling prioritized oversight and resource allocation.

Question 5

When a critical vendor announces it is going out of business, the organization should FIRST:

Accepted Answer

Activate contingency or exit plans and identify alternative vendors

Answer

Activating exit and contingency plans ensures business continuity by transitioning to alternative vendors or in-house capabilities before service disruption occurs.

CRISC - Certified in Risk and Information Systems Control Practice Test

CRISC - Certified in Risk and Information Systems Control Practice Test

CRISC Third-Party and Vendor Risk Management 3