DRI DRI Supply Chain & Third-Party Risk Management 1 — Questions and Answers
Question 1: What is the primary purpose of a third-party risk assessment in business continuity planning?
- To evaluate vendors' ability to continue services during a disruption (Correct answer)
- To negotiate lower contract prices with suppliers
- To identify which vendors offer the most features
- To determine marketing partnership opportunities
Correct answer: To evaluate vendors' ability to continue services during a disruption
Third-party risk assessments evaluate whether vendors and suppliers can maintain critical services during a disruption, ensuring the organization's continuity is not jeopardized by external dependencies.
Question 2: Which document formally outlines the recovery expectations and responsibilities between an organization and its critical vendors?
- Service Level Agreement (SLA) (Correct answer)
- Non-Disclosure Agreement (NDA)
- Statement of Work (SOW)
- Memorandum of Understanding (MOU)
Correct answer: Service Level Agreement (SLA)
A Service Level Agreement (SLA) formally defines the expected performance levels, recovery time obligations, and responsibilities of vendors during normal and disrupted operations.
Question 3: What is 'concentration risk' in the context of supply chain continuity?
- Over-reliance on a single vendor or geographic region for critical supplies (Correct answer)
- The risk of losing focus during an incident
- Having too many vendors for one product
- Concentrating recovery resources at one site
Correct answer: Over-reliance on a single vendor or geographic region for critical supplies
Concentration risk occurs when an organization depends too heavily on a single supplier or region, creating a single point of failure that can disrupt the entire supply chain.
Question 4: During a supply chain disruption, what is the FIRST step an organization should take according to DRI best practices?
- Activate pre-identified alternate suppliers (Correct answer)
- Immediately notify all customers of the disruption
- Suspend all operations until the supplier recovers
- Renegotiate the current supplier contract
Correct answer: Activate pre-identified alternate suppliers
DRI best practices call for activating pre-identified alternate suppliers first to maintain operational continuity while the primary supplier disruption is addressed.
Question 5: Which of the following BEST describes a 'fourth-party risk'?
- Risk posed by your vendor's vendors who also support your operations (Correct answer)
- Risk from four separate vendor failures occurring simultaneously
- Risk from the fourth tier of your organization's hierarchy
- Risk from vendors in four different geographic locations
Correct answer: Risk posed by your vendor's vendors who also support your operations
Fourth-party risk refers to the risk introduced by the subcontractors and suppliers that your own vendors rely upon, creating an extended chain of dependency.
Question 6: What is the recommended frequency for reviewing third-party business continuity plans according to DRI guidelines?
- At least annually or after any significant change (Correct answer)
- Only when a disruption occurs
- Every five years during contract renewal
- Quarterly regardless of any changes
Correct answer: At least annually or after any significant change
DRI guidelines recommend reviewing third-party BCPs at least annually or following significant organizational or operational changes to ensure continued alignment.
DRI DRI Supply Chain & Third-Party Risk Management 1
What is the primary purpose of a third-party risk assessment in business continuity planning?