DRI DRI Supply Chain & Third-Party Risk Management 2 — Questions and Answers
Question 1: What is the purpose of a 'vendor continuity questionnaire' in third-party risk management?
- To assess a vendor's preparedness and BC/DR capabilities before or during a contract (Correct answer)
- To determine a vendor's pricing structure for emergency services
- To identify the vendor's marketing strategy
- To evaluate employee satisfaction at the vendor organization
Correct answer: To assess a vendor's preparedness and BC/DR capabilities before or during a contract
A vendor continuity questionnaire helps organizations assess how well a potential or existing vendor is prepared to maintain services during disruptions before relying on them for critical functions.
Question 2: Which strategy BEST mitigates supply chain single points of failure?
- Dual-sourcing or multi-sourcing critical components from different vendors (Correct answer)
- Signing longer contracts with existing vendors
- Increasing order frequency from the primary vendor
- Requiring vendors to carry more inventory
Correct answer: Dual-sourcing or multi-sourcing critical components from different vendors
Dual-sourcing or multi-sourcing ensures that if one supplier fails, alternative suppliers can fulfill the need, eliminating single points of failure in the supply chain.
Question 3: In DRI's Professional Practices, which element is critical when onboarding a new critical vendor?
- Validating that the vendor has a tested and documented BC plan (Correct answer)
- Confirming the vendor's social media presence
- Verifying the vendor's office location is convenient
- Ensuring the vendor uses the same software as your organization
Correct answer: Validating that the vendor has a tested and documented BC plan
DRI's Professional Practices require validating that critical vendors have documented, tested BC plans to ensure they can maintain service delivery under adverse conditions.
Question 4: What does 'right to audit' in a vendor contract typically allow an organization to do?
- Review and verify the vendor's BC/DR plans and testing results (Correct answer)
- Access the vendor's financial records for tax purposes
- Change the vendor's internal processes at will
- Set the vendor's employee performance standards
Correct answer: Review and verify the vendor's BC/DR plans and testing results
A 'right to audit' clause contractually permits an organization to review a vendor's business continuity plans, test results, and controls to verify compliance with agreed standards.
Question 5: Which metric is MOST relevant when evaluating a vendor's ability to meet your RTO requirements?
- The vendor's own documented RTO for services your organization depends on (Correct answer)
- The vendor's annual revenue and profitability
- The number of employees at the vendor's headquarters
- The vendor's geographic proximity to your offices
Correct answer: The vendor's own documented RTO for services your organization depends on
The vendor's own documented RTO for the services you depend on directly determines whether they can recover and restore your services within your required timeframe.
Question 6: When a critical supplier experiences a disruption, which communication approach aligns with DRI best practices?
- Immediately activate your pre-established vendor notification and escalation protocol (Correct answer)
- Wait 24 hours to assess the full scope before taking action
- Notify all internal staff before contacting the vendor
- Post updates on social media to manage public expectations
Correct answer: Immediately activate your pre-established vendor notification and escalation protocol
DRI best practices call for immediate activation of pre-established vendor notification and escalation protocols to quickly assess impact and trigger appropriate continuity responses.
DRI DRI Supply Chain & Third-Party Risk Management 2
What is the purpose of a 'vendor continuity questionnaire' in third-party risk management?