CTO Vendor Management & Procurement 4 — Questions and Answers
Question 1: What is the primary risk of relying on a single-source vendor for a mission-critical technology component?
- Reduced negotiating leverage and supply chain concentration risk creating potential single points of failure (Correct answer)
- Higher administrative overhead from managing one vendor relationship
- Difficulty tracking spending across multiple budget categories
- Increased integration complexity compared to multi-vendor environments
Correct answer: Reduced negotiating leverage and supply chain concentration risk creating potential single points of failure
Single-source dependency eliminates competitive leverage and creates operational vulnerability if the vendor experiences disruption, financial failure, or service degradation.
Question 2: A vendor proposes adding a usage-based pricing model to replace a flat annual license. Under what circumstances is this advantageous for the buyer?
- When usage is predictable and consistently high throughout the year
- When usage is variable, seasonal, or growth is uncertain, aligning cost to actual consumption (Correct answer)
- When the organization has a fixed IT budget with no flexibility for variable costs
- When the vendor offers no volume discounts under the usage-based model
Correct answer: When usage is variable, seasonal, or growth is uncertain, aligning cost to actual consumption
Usage-based pricing benefits organizations with variable or unpredictable demand by eliminating the cost of unused capacity.
Question 3: During a third-party security audit of a critical vendor, auditors identify multiple unpatched critical CVEs in production systems. What is the CTO's immediate priority?
- Terminate the vendor contract immediately
- Issue a formal remediation demand with a defined patch timeline and escalation path, and assess compensating controls (Correct answer)
- Notify customers of the vendor's security posture
- Wait for the vendor's next scheduled patch cycle
Correct answer: Issue a formal remediation demand with a defined patch timeline and escalation path, and assess compensating controls
A formal remediation demand with timelines and compensating control assessment balances urgency with contractual process and operational continuity.
Question 4: What does 'right to audit' in a vendor contract specifically enable the purchasing organization to do?
- Review the vendor's financial statements at any time
- Inspect the vendor's compliance with contractual obligations, security controls, and data handling practices (Correct answer)
- Override the vendor's internal policies with the buyer's standards
- Terminate the contract without penalty if any audit finding is identified
Correct answer: Inspect the vendor's compliance with contractual obligations, security controls, and data handling practices
Right-to-audit clauses grant the buyer access to verify contractual compliance, security posture, and data governance practices, not financial oversight.
Question 5: When building a vendor scorecard, which combination of dimensions provides the most balanced view of vendor performance?
- Price, employee count, and years in business
- SLA attainment, innovation contribution, relationship quality, and financial stability (Correct answer)
- Number of support tickets resolved and average response time only
- Contract compliance and invoice accuracy only
Correct answer: SLA attainment, innovation contribution, relationship quality, and financial stability
A balanced scorecard spanning performance, innovation, relationship, and financial health captures both current delivery and long-term partnership value.
Question 6: What is the most effective approach to managing software license compliance across an enterprise with hundreds of vendors?
- Conduct manual audits annually using spreadsheets
- Implement a Software Asset Management (SAM) tool that continuously reconciles entitlements against deployments (Correct answer)
- Rely on vendors to notify the organization of non-compliance
- Purchase the maximum license tier for all software to avoid any compliance risk
Correct answer: Implement a Software Asset Management (SAM) tool that continuously reconciles entitlements against deployments
SAM tools provide continuous automated reconciliation of licenses versus usage, preventing both over-spend and audit exposure.
Question 7: A vendor's offshore development team is responsible for a significant portion of your product's codebase. What intellectual property protection is most critical?
- Requiring the vendor to use the buyer's development tools exclusively
- Ensuring the contract includes a work-made-for-hire clause or IP assignment provision covering all deliverables (Correct answer)
- Registering the vendor's employees as co-inventors on relevant patents
- Limiting the vendor to maintenance tasks only, not new development
Correct answer: Ensuring the contract includes a work-made-for-hire clause or IP assignment provision covering all deliverables
Work-for-hire or IP assignment clauses ensure ownership of code produced by third-party developers vests unambiguously in the buying organization.
CTO Vendor Management & Procurement 4
What is the primary risk of relying on a single-source vendor for a mission-critical technology component?