GRC Third-Party Risk Management 2

Question 1

Which document establishes the specific security and compliance requirements a vendor must meet as part of a contract?

Accepted Answer

Security Addendum / Exhibit

Answer

A security addendum or exhibit appended to a contract spells out the specific technical and compliance controls the vendor must satisfy.

Question 2

A fourth-party risk is BEST described as:

Accepted Answer

Risk arising from your vendor's vendors and subcontractors

Answer

Fourth-party risk refers to the risks posed by subcontractors or suppliers that your direct (third-party) vendors rely upon.

Question 3

During which TPRM lifecycle phase would an organization typically perform on-site audits and review vendor SOC 2 reports?

Accepted Answer

Ongoing monitoring

Answer

Ongoing monitoring includes periodic reviews of audit reports, on-site assessments, and continuous control validation throughout the vendor relationship.

Question 4

What is the primary purpose of a vendor risk tiering model?

Accepted Answer

To allocate due diligence intensity based on the risk each vendor poses

Answer

Risk tiering ensures that high-risk vendors receive more rigorous due diligence while low-risk vendors receive lighter-touch reviews, optimizing resources.

Question 5

Which of the following is a leading indicator that a vendor may be experiencing financial distress, increasing supply chain risk?

Accepted Answer

Vendor's credit rating is downgraded by a major agency

Answer

A credit rating downgrade signals deteriorating financial health, which can jeopardize a vendor's ability to fulfill contractual obligations.

(GRC) Governance, Risk, and Compliance Certification Practice Test

(GRC) Governance, Risk, and Compliance Certification Practice Test

GRC Third-Party Risk Management 2