Contract Management and Vendor Oversight Flashcards

A vendor refuses to allow a direct on-site audit citing proprietary business concerns. What is an acceptable ALTERNATIVE oversight mechanism that many contracts permit?

Answer: Accepting a third-party audit report such as a SOC 2 Type II in lieu of a direct audit

SOC 2 Type II and similar independent third-party audit reports are widely accepted substitutes that provide credible assurance without requiring direct access.

What is the purpose of including a 'step-in rights' clause in a vendor contract?

Answer: It grants the organization the right to assume direct control of vendor operations if the vendor fails to perform

Step-in rights allow the contracting organization to take over or redirect the vendor's operations during a service failure, protecting business continuity.

An organization is building a vendor contract template. Which element is MOST important to include to address data privacy compliance under US state privacy laws such as CCPA?

Answer: A data processing addendum (DPA) defining roles, processing purposes, and data subject rights obligations

A DPA establishes the legal framework for data processing, aligning with CCPA and similar regulations by defining controller/processor roles and obligations.

A contract manager notices that a vendor's insurance certificate on file has expired. What is the IMMEDIATE risk concern?

Answer: The organization may have no recourse for losses caused by an uninsured vendor incident

An expired insurance certificate leaves the organization exposed to unrecoverable losses if the vendor causes a covered incident during the lapse period.

In vendor oversight, what does 'evergreen contract' risk refer to?

Answer: Contracts that automatically renew without a periodic risk reassessment or renegotiation

Evergreen contracts auto-renew, creating risk that outdated terms, unreviewed performance, or changed risk profiles persist without deliberate management oversight.

A vendor contract includes a limitation of liability clause capping damages at one year's contract fees. During an incident, actual damages total five times the annual fee. What is the MOST significant implication for the organization?

Answer: The organization can only recover up to the capped amount, leaving it exposed to the remaining loss

Contractual liability caps are generally enforceable, meaning the organization bears any losses exceeding the cap unless specific carve-outs for gross negligence or willful misconduct apply.

Which of the following BEST describes a 'material breach' provision in a third-party contract and its relevance to vendor risk management?

Answer: A defined threshold of non-performance or violation that triggers the right to terminate the contract without penalty

A material breach provision defines what constitutes a fundamental contract violation, giving the organization a clear, legally defensible right to terminate and seek remedies.