CTPRP Contract Management and Vendor Oversight 3

Question 1

Which regulatory guideline most directly influences how U.S. financial institutions structure their vendor contracts and oversight programs?

Accepted Answer

OCC Bulletin 2013-29 on Third-Party Relationships

Answer

OCC Bulletin 2013-29 provides comprehensive guidance specifically for national banks on managing risks from third-party relationships throughout the vendor lifecycle, including contract requirements.

Question 2

A 'termination for convenience' clause in a vendor contract is best described as:

Accepted Answer

A clause permitting the organization to terminate the contract without cause, typically with advance notice

Answer

Termination for convenience allows the organization to exit a vendor relationship without needing to prove cause or breach, providing flexibility to respond to business changes, with notice requirements specified.

Question 3

When evaluating vendor contracts for concentration risk, which scenario represents the HIGHEST concern?

Accepted Answer

Relying on a single cloud provider for 90% of core banking infrastructure with no viable alternative

Answer

Relying on one vendor for the vast majority of critical infrastructure creates dangerous concentration risk, as a vendor outage or failure would severely impact core business operations with no ready alternative.

Question 4

Which element of a vendor contract specifically addresses the legal responsibilities and obligations each party assumes if a third party suffers harm due to the vendor's actions?

Accepted Answer

Indemnification clause

Answer

An indemnification clause defines which party bears the financial responsibility for losses, claims, or damages caused by their actions or negligence, including third-party claims.

Question 5

A vendor's failure to notify the organization of a significant data breach within the contractually required timeframe is BEST addressed through which contract provision?

Accepted Answer

Incident notification and response obligations

Answer

Incident notification provisions specify the timeframe and process by which a vendor must inform the organization of security incidents or breaches, enabling timely response and regulatory compliance.

(CTPRP) Certified Third Party Risk Professional Practice Test

(CTPRP) Certified Third Party Risk Professional Practice Test

CTPRP Contract Management and Vendor Oversight 3