CTPRP Contract Management and Vendor Oversight 5

Question 1

A vendor refuses to allow a direct on-site audit citing proprietary business concerns. What is an acceptable ALTERNATIVE oversight mechanism that many contracts permit?

Accepted Answer

Accepting a third-party audit report such as a SOC 2 Type II in lieu of a direct audit

Answer

SOC 2 Type II and similar independent third-party audit reports are widely accepted substitutes that provide credible assurance without requiring direct access.

Question 2

What is the purpose of including a 'step-in rights' clause in a vendor contract?

Accepted Answer

It grants the organization the right to assume direct control of vendor operations if the vendor fails to perform

Answer

Step-in rights allow the contracting organization to take over or redirect the vendor's operations during a service failure, protecting business continuity.

Question 3

An organization is building a vendor contract template. Which element is MOST important to include to address data privacy compliance under US state privacy laws such as CCPA?

Accepted Answer

A data processing addendum (DPA) defining roles, processing purposes, and data subject rights obligations

Answer

A DPA establishes the legal framework for data processing, aligning with CCPA and similar regulations by defining controller/processor roles and obligations.

Question 4

A contract manager notices that a vendor's insurance certificate on file has expired. What is the IMMEDIATE risk concern?

Accepted Answer

The organization may have no recourse for losses caused by an uninsured vendor incident

Answer

An expired insurance certificate leaves the organization exposed to unrecoverable losses if the vendor causes a covered incident during the lapse period.

Question 5

In vendor oversight, what does 'evergreen contract' risk refer to?

Accepted Answer

Contracts that automatically renew without a periodic risk reassessment or renegotiation

Answer

Evergreen contracts auto-renew, creating risk that outdated terms, unreviewed performance, or changed risk profiles persist without deliberate management oversight.

(CTPRP) Certified Third Party Risk Professional Practice Test

(CTPRP) Certified Third Party Risk Professional Practice Test

CTPRP Contract Management and Vendor Oversight 5