CTPRP Regulatory Compliance and Vendor Governance 4

Question 1

Under the OCC's third-party risk management guidance, which activity requires the MOST rigorous due diligence before engagement?

Accepted Answer

Critical activities that could harm consumers if the third party fails

Answer

OCC guidance requires the most rigorous due diligence for third parties performing critical activities, especially those that could harm consumers or the bank if the arrangement fails.

Question 2

A financial institution discovers a vendor is subcontracting a critical function to a fourth party without notification. Which regulatory requirement does this MOST likely violate?

Accepted Answer

Contract provisions requiring prior approval of subcontracting arrangements

Answer

Most regulatory frameworks require vendors to obtain prior approval before subcontracting critical functions, and contracts should contain provisions explicitly addressing fourth-party arrangements.

Question 3

Which element is MOST critical when conducting vendor due diligence for a cloud service provider handling regulated data?

Accepted Answer

The vendor's SOC 2 Type II report and data residency controls

Answer

A SOC 2 Type II report provides evidence of operational effectiveness of security controls over time, while data residency controls confirm compliance with data sovereignty regulations.

Question 4

Under GDPR, when a US company uses a European vendor to process EU personal data, the US company is classified as the:

Accepted Answer

Data controller responsible for determining processing purposes

Answer

Under GDPR, the entity that determines the purposes and means of processing personal data is the data controller, which retains ultimate responsibility for compliance.

Question 5

A vendor governance framework should include 'right to audit' clauses primarily to:

Accepted Answer

Verify vendor compliance with contractual and regulatory requirements

Answer

Right-to-audit clauses give organizations the contractual authority to verify that vendors are meeting their compliance obligations and adhering to agreed security standards.

(CTPRP) Certified Third Party Risk Professional Practice Test

(CTPRP) Certified Third Party Risk Professional Practice Test

CTPRP Regulatory Compliance and Vendor Governance 4