Ongoing Monitoring and Continuous Oversight Flashcards

Which factor should MOST influence the frequency of ongoing monitoring reviews for a third-party vendor?

Answer: The vendor's inherent risk tier assigned during initial onboarding

Ongoing monitoring frequency is driven primarily by the inherent risk tier. High-risk vendors (those with access to sensitive data, critical systems, or regulated functions) require more frequent reassessments than low-risk vendors. Contract renewal dates, headcount, and geography are secondary or irrelevant without a risk-tier context.

A vendor that previously scored 'low risk' in its initial due diligence assessment has just disclosed a major data breach affecting another client. What is the MOST appropriate immediate action?

Answer: Trigger an out-of-cycle risk reassessment and request an incident report from the vendor

A material adverse event — such as a data breach — is a recognized trigger for an out-of-cycle reassessment. The organization must quickly understand whether the breach affects its own data or services before deciding on next steps. Waiting for an annual review ignores an emerging risk; immediate termination without investigation is premature.

Key Risk Indicators (KRIs) used in continuous vendor monitoring are BEST described as:

Answer: Forward-looking metrics that signal rising risk before an adverse event occurs

KRIs are predictive, forward-looking indicators designed to warn that risk is increasing before an adverse event materializes. They differ from Key Performance Indicators (KPIs), which measure outcomes, and from audit findings or SLA penalties, which are reactive.

Which of the following is a recognized TRIGGER for an unscheduled reassessment of a third-party vendor?

Answer: The vendor is acquired by or merges with another company

A merger or acquisition of the vendor is a classic trigger for an out-of-cycle reassessment because it can fundamentally change the vendor's ownership, controls, financial stability, and subcontractor relationships. Completing a routine audit, internal sponsor changes, or entering a final contract year do not by themselves constitute material risk events.

What is the PRIMARY purpose of maintaining a vendor inventory as part of an ongoing monitoring program?

Answer: To enable risk-tiered oversight and ensure no vendor relationship goes unmonitored

A complete, accurate vendor inventory is foundational to third-party risk management because you cannot monitor what you cannot see. It allows the organization to apply risk-tiered controls to every vendor, preventing gaps in oversight. While an inventory may satisfy audit requirements as a byproduct, risk visibility is the primary driver.

Which monitoring approach is MOST appropriate for a critical vendor providing core payment processing services?

Answer: Continuous automated monitoring supplemented by periodic on-site assessments

Critical vendors warrant the most rigorous monitoring. Combining automated, real-time signals (e.g., threat intelligence feeds, uptime monitoring) with periodic deeper assessments — including on-site reviews — provides the layered assurance appropriate for high-risk, high-criticality relationships. Annual self-assessments alone are insufficient for critical vendors.