CRO Third-Party Risk Assessment 2

Question 1

Which due diligence tier typically applies to a third-party vendor that processes protected health information (PHI) on behalf of a covered entity?

Accepted Answer

Tier 3 — enhanced due diligence with on-site audit rights

Answer

Vendors handling PHI are classified as business associates under HIPAA and require enhanced due diligence, including audit rights and Business Associate Agreements.

Question 2

A CRO discovers a critical vendor has been acquired by a competitor. What is the FIRST risk management action to take?

Accepted Answer

Re-evaluate the vendor's risk profile and assess concentration risk

Answer

An ownership change triggers a re-assessment of the vendor's risk profile, including data access, service continuity, and potential conflicts of interest.

Question 3

What does 'nth-party risk' refer to in third-party risk management?

Accepted Answer

Risk arising from a vendor's own subcontractors and their supply chain

Answer

Nth-party risk refers to risks introduced by sub-vendors, sub-processors, and the extended supply chain beyond the direct third party.

Question 4

Under the OCC's third-party risk management guidance, which activity requires the MOST stringent oversight?

Accepted Answer

Outsourcing a core banking function to a fintech partner

Answer

The OCC requires the most stringent oversight for critical activities, especially outsourced core banking functions that could affect safety, soundness, or compliance.

Question 5

Which metric BEST measures the effectiveness of a third-party risk program over time?

Accepted Answer

Percentage of vendors with completed risk assessments within the review cycle

Answer

Assessment completion rate within the defined review cycle directly measures program effectiveness and identifies gaps in ongoing monitoring.

(CRO) Chief Risk Officer Certification Practice Test

(CRO) Chief Risk Officer Certification Practice Test

CRO Third-Party Risk Assessment 2