GRC Third-Party Risk Management 2

Question 1

Which document establishes the specific security and compliance requirements a vendor must meet as part of a contract?

Accepted Answer

Security Addendum / Exhibit

Answer

Service Level Agreement (SLA)

Answer

Business Associate Agreement (BAA)

Answer

Master Service Agreement (MSA)

Question 2

A fourth-party risk is BEST described as:

Accepted Answer

Risk arising from your vendor's vendors and subcontractors

Answer

Risk from a vendor's own employees committing fraud

Answer

Risk that your organization fails to pay a vendor on time

Answer

Risk introduced by open-source software used internally

Question 3

During which TPRM lifecycle phase would an organization typically perform on-site audits and review vendor SOC 2 reports?

Accepted Answer

Ongoing monitoring

Answer

Vendor selection

Answer

Contract negotiation

Answer

Vendor offboarding

Question 4

What is the primary purpose of a vendor risk tiering model?

Accepted Answer

To allocate due diligence intensity based on the risk each vendor poses

Answer

To rank vendors by revenue contribution for budgeting

Answer

To identify which vendors should receive volume discounts

Answer

To sequence vendor contract renewal dates

Question 5

Which of the following is a leading indicator that a vendor may be experiencing financial distress, increasing supply chain risk?

Accepted Answer

Vendor's credit rating is downgraded by a major agency

Answer

Vendor expands its product line

Answer

Vendor hires additional customer support staff

Answer

Vendor opens a new regional office

Question 6

An organization discovers that a critical SaaS vendor stores data in jurisdictions not listed in the contract. Which risk domain is MOST directly implicated?

Accepted Answer

Regulatory and compliance risk

Answer

Reputational risk

Answer

Operational availability risk

Answer

Vendor concentration risk

Question 7

The Right to Audit clause in a vendor contract primarily serves to:

Accepted Answer

Grant the organization the ability to examine the vendor's controls and records

Answer

Allow the vendor to audit the client's systems for compliance

Answer

Establish financial penalties for service outages

Answer

Define the vendor's liability cap for data breaches