Regulatory Compliance and Vendor Governance Flashcards

Under the OCC's third-party risk management guidance, which activity requires the MOST rigorous due diligence before engagement?

Answer: Critical activities that could harm consumers if the third party fails

OCC guidance requires the most rigorous due diligence for third parties performing critical activities, especially those that could harm consumers or the bank if the arrangement fails.

A financial institution discovers a vendor is subcontracting a critical function to a fourth party without notification. Which regulatory requirement does this MOST likely violate?

Answer: Contract provisions requiring prior approval of subcontracting arrangements

Most regulatory frameworks require vendors to obtain prior approval before subcontracting critical functions, and contracts should contain provisions explicitly addressing fourth-party arrangements.

Which element is MOST critical when conducting vendor due diligence for a cloud service provider handling regulated data?

Answer: The vendor's SOC 2 Type II report and data residency controls

A SOC 2 Type II report provides evidence of operational effectiveness of security controls over time, while data residency controls confirm compliance with data sovereignty regulations.

Under GDPR, when a US company uses a European vendor to process EU personal data, the US company is classified as the:

Answer: Data controller responsible for determining processing purposes

Under GDPR, the entity that determines the purposes and means of processing personal data is the data controller, which retains ultimate responsibility for compliance.

A vendor governance framework should include 'right to audit' clauses primarily to:

Answer: Verify vendor compliance with contractual and regulatory requirements

Right-to-audit clauses give organizations the contractual authority to verify that vendors are meeting their compliance obligations and adhering to agreed security standards.

Which regulatory framework specifically requires financial institutions to maintain a comprehensive inventory of critical third-party service providers?

Answer: FFIEC IT Examination Handbook on Third-Party Risk

The FFIEC IT Examination Handbook provides guidance requiring financial institutions to maintain inventories of third-party relationships, particularly those involving critical services.

When a vendor experiences a data breach, which action should the contracting organization take FIRST according to best-practice vendor governance?

Answer: Invoke contractual breach notification requirements and assess exposure

The immediate priority is to invoke contractual breach notification provisions to understand the scope of exposure and coordinate the incident response according to established procedures.