CSM CSM Vendor Management & Procurement 2 — Questions and Answers
Question 1: What is the purpose of a 'right to audit' clause in a software vendor contract?
- It allows the vendor to audit the client's internal processes
- It grants the client the right to inspect the vendor's records to verify compliance with contract terms (Correct answer)
- It requires the vendor to publish annual financial reports
- It allows either party to terminate the contract without penalty
Correct answer: It grants the client the right to inspect the vendor's records to verify compliance with contract terms
A right-to-audit clause gives the client contractual authority to examine the vendor's records, processes, and controls to verify that contractual, regulatory, and security obligations are being met.
Question 2: In software outsourcing, what is a Statement of Work (SOW)?
- A high-level business case for outsourcing
- A detailed document specifying deliverables, timelines, acceptance criteria, and responsibilities for a specific project (Correct answer)
- A vendor's self-assessment of their capabilities
- A summary of all past work completed by the vendor
Correct answer: A detailed document specifying deliverables, timelines, acceptance criteria, and responsibilities for a specific project
An SOW defines precisely what work will be done, what will be delivered, when, and how quality will be measured, forming the technical foundation of an outsourcing contract.
Question 3: A software manager is evaluating two vendors with similar capabilities. Vendor A is 20% cheaper but has no US data center presence. Vendor B has US data centers but costs more. For a US healthcare application, which factor should tip the decision toward Vendor B?
- Brand recognition in the market
- HIPAA compliance requirements that mandate data residency controls (Correct answer)
- Vendor B's larger sales team
- The cost difference is too small to matter for compliance
Correct answer: HIPAA compliance requirements that mandate data residency controls
HIPAA requires covered entities to ensure that PHI is protected with appropriate safeguards, and data residency within the US with a Business Associate Agreement (BAA) is typically necessary.
Question 4: What is the key purpose of conducting a vendor risk assessment before signing a software contract?
- To negotiate a lower contract price
- To identify potential risks (financial, security, operational) the vendor poses to the organization (Correct answer)
- To evaluate the vendor's marketing materials
- To determine how many developers the vendor employs
Correct answer: To identify potential risks (financial, security, operational) the vendor poses to the organization
A vendor risk assessment identifies and evaluates threats from the vendor relationship—such as data breach risk, business continuity risk, and regulatory exposure—before commitment.
Question 5: Which procurement document is typically released BEFORE an RFP when an organization wants to gauge market interest and gather preliminary capability information?
- Request for Quotation (RFQ)
- Request for Information (RFI) (Correct answer)
- Invitation for Bid (IFB)
- Letter of Intent (LOI)
Correct answer: Request for Information (RFI)
An RFI is issued early in the procurement process to gather general market information and vendor capabilities before defining detailed requirements for a formal RFP.
Question 6: In vendor contract negotiations, what is an 'escrow agreement' for software source code?
- A payment plan where funds are held by a neutral third party until deliverables are accepted
- An arrangement where source code is held by a neutral third party and released to the client if the vendor fails (Correct answer)
- A clause that limits the vendor's liability for source code defects
- A software licensing agreement for on-premise deployment
Correct answer: An arrangement where source code is held by a neutral third party and released to the client if the vendor fails
A source code escrow agreement protects the client by having a third party hold the vendor's source code, releasing it to the client if the vendor goes bankrupt or ceases to support the product.
CSM CSM Vendor Management & Procurement 2
What is the purpose of a 'right to audit' clause in a software vendor contract?