Contract Management and Vendor Oversight Flashcards

Which key performance indicator (KPI) is most relevant to monitoring a vendor's operational risk in an outsourced IT service?

Answer: System uptime and availability percentage against contracted SLAs

System uptime and availability measured against SLA thresholds directly reflects operational risk and ensures the vendor is delivering the contractually agreed service levels.

What is 'contract risk concentration' in third-party risk management?

Answer: Over-reliance on a single vendor for a critical service, increasing exposure if that vendor fails

Contract risk concentration occurs when an organization relies heavily on one vendor for a critical service, creating a single point of failure that can be catastrophic if the vendor experiences an outage or failure.

During ongoing vendor oversight, a 'change management' provision in a contract is designed to:

Answer: Require the vendor to notify and obtain approval for significant changes to personnel, systems, or processes

Change management provisions require vendors to formally notify the organization and seek approval before making material changes that could affect service quality, security posture, or compliance.

In vendor contract negotiations, an 'escrow arrangement' for software source code primarily protects the organization from:

Answer: The risk of losing access to critical software if the vendor goes out of business or is acquired

A source code escrow arrangement ensures that if a software vendor ceases operations or cannot support the product, the organization can access the source code to maintain or migrate the software.

Which of the following is the BEST reason to include a 'benchmarking' clause in a long-term vendor contract?

Answer: To enable the organization to periodically compare vendor pricing and performance against market standards

A benchmarking clause allows the organization to periodically compare the vendor's pricing and service quality against market peers, ensuring ongoing value and competitiveness over the contract's life.

What is the primary risk management benefit of establishing a formal vendor offboarding process?

Answer: It ensures all access is revoked, data is returned or destroyed, and transition risks are managed in an orderly manner

A formal offboarding process mitigates risks associated with contract termination by ensuring all access credentials are revoked, sensitive data is handled appropriately, and transition activities are completed without gaps.

In a third-party risk context, 'contract tiering' refers to:

Answer: Applying different levels of contractual requirements and oversight based on a vendor's risk classification

Contract tiering aligns contractual requirements and monitoring intensity with the vendor's risk level, so high-risk critical vendors face more stringent obligations than lower-risk vendors.