Contract Management and Vendor Oversight Flashcards

A vendor's contract is up for renewal, but the vendor has repeatedly missed SLA targets. What is the MOST appropriate first action before renegotiating terms?

Answer: Conduct a formal performance review and document all SLA breaches

Documenting SLA breaches through a formal performance review creates an evidence-based foundation for renegotiation or termination decisions.

Which contract clause specifically grants the organization the legal right to inspect a vendor's operational processes, financial records, and security controls?

Answer: Right-to-audit clause

A right-to-audit clause explicitly authorizes the contracting organization to examine vendor operations, finances, and controls to verify compliance.

A third-party vendor discloses that it has subcontracted a critical function to a fourth party without prior approval. What risk management concern does this PRIMARILY raise?

Answer: Nth-party risk due to lack of visibility and control

Unapproved subcontracting introduces nth-party risk because the organization has no direct contractual relationship or oversight over the fourth party.

During contract negotiations, a vendor insists on a mutual indemnification clause. What does mutual indemnification mean for the contracting organization?

Answer: Both parties agree to hold each other harmless for their respective breaches or negligence

Mutual indemnification means each party agrees to defend and compensate the other for losses arising from its own negligence or breach, creating reciprocal protection.

An organization's vendor management policy requires quarterly business reviews (QBRs) for Tier 1 vendors. What is the PRIMARY purpose of a QBR?

Answer: To assess vendor performance, discuss strategic alignment, and address emerging risks

QBRs provide a structured forum to review performance against SLAs, align on strategic objectives, and proactively identify and mitigate emerging risks.

A financial institution's regulator requires that all vendor contracts include provisions for business continuity and disaster recovery. Which contract element BEST satisfies this requirement?

Answer: A business continuity and disaster recovery (BC/DR) addendum with tested RTO and RPO commitments

A BC/DR addendum with specific, tested RTO and RPO commitments directly addresses regulatory requirements for operational resilience and continuity planning.

When a vendor contract expires and the relationship is transitioning to a new provider, which activity is MOST critical from a risk management perspective?

Answer: Ensuring a data return, destruction, and transition assistance clause was included in the original contract

Pre-negotiated data return, destruction, and transition assistance provisions ensure a controlled offboarding that protects data and maintains service continuity.