Third-Party Risk Assessment and Due Diligence Flashcards

In the US, which regulatory guidance specifically addresses third-party risk management for financial institutions?

Answer: OCC Bulletin 2013-29

OCC Bulletin 2013-29 provides guidance to national banks and federal savings associations on managing risks in third-party relationships throughout the vendor lifecycle.

Which technique helps identify high-risk vendors quickly when managing a large vendor portfolio?

Answer: Risk tiering based on criticality and data access

Risk tiering categorizes vendors by their criticality to operations and level of data access, enabling organizations to allocate due diligence resources proportionally to risk.

What is the purpose of a vendor risk register?

Answer: To document identified risks, their likelihood, impact, and treatment for each vendor

A vendor risk register is a structured record that captures the risks associated with each vendor, their risk ratings, and the actions taken to treat or monitor those risks.

Which control domain is typically evaluated when assessing a vendor's physical security during due diligence?

Answer: Access controls for facilities, server rooms, and sensitive areas

Physical security assessments focus on controls such as badge access, CCTV, visitor logs, and secure areas to determine whether unauthorized physical access can be prevented.

When a vendor's assessment reveals a critical control gap, what is the recommended immediate action?

Answer: Issue a formal remediation request with a defined timeline

A formal remediation request with a defined timeline ensures accountability while giving the vendor a structured opportunity to address the gap before escalating to contract action.

What is 'continuous monitoring' in the context of third-party risk management?

Answer: Ongoing surveillance of vendor risk indicators between formal assessment cycles

Continuous monitoring uses automated tools, threat intelligence feeds, and periodic check-ins to detect changes in vendor risk posture between scheduled formal assessments.