GRC Third-Party Risk Management 2 — Questions and Answers
Question 1: Which document establishes the specific security and compliance requirements a vendor must meet as part of a contract?
- Service Level Agreement (SLA)
- Business Associate Agreement (BAA)
- Security Addendum / Exhibit (Correct answer)
- Master Service Agreement (MSA)
Correct answer: Security Addendum / Exhibit
A security addendum or exhibit appended to a contract spells out the specific technical and compliance controls the vendor must satisfy.
Question 2: A fourth-party risk is BEST described as:
- Risk from a vendor's own employees committing fraud
- Risk arising from your vendor's vendors and subcontractors (Correct answer)
- Risk that your organization fails to pay a vendor on time
- Risk introduced by open-source software used internally
Correct answer: Risk arising from your vendor's vendors and subcontractors
Fourth-party risk refers to the risks posed by subcontractors or suppliers that your direct (third-party) vendors rely upon.
Question 3: During which TPRM lifecycle phase would an organization typically perform on-site audits and review vendor SOC 2 reports?
- Vendor selection
- Contract negotiation
- Ongoing monitoring (Correct answer)
- Vendor offboarding
Correct answer: Ongoing monitoring
Ongoing monitoring includes periodic reviews of audit reports, on-site assessments, and continuous control validation throughout the vendor relationship.
Question 4: What is the primary purpose of a vendor risk tiering model?
- To rank vendors by revenue contribution for budgeting
- To allocate due diligence intensity based on the risk each vendor poses (Correct answer)
- To identify which vendors should receive volume discounts
- To sequence vendor contract renewal dates
Correct answer: To allocate due diligence intensity based on the risk each vendor poses
Risk tiering ensures that high-risk vendors receive more rigorous due diligence while low-risk vendors receive lighter-touch reviews, optimizing resources.
Question 5: Which of the following is a leading indicator that a vendor may be experiencing financial distress, increasing supply chain risk?
- Vendor expands its product line
- Vendor's credit rating is downgraded by a major agency (Correct answer)
- Vendor hires additional customer support staff
- Vendor opens a new regional office
Correct answer: Vendor's credit rating is downgraded by a major agency
A credit rating downgrade signals deteriorating financial health, which can jeopardize a vendor's ability to fulfill contractual obligations.
Question 6: An organization discovers that a critical SaaS vendor stores data in jurisdictions not listed in the contract. Which risk domain is MOST directly implicated?
- Reputational risk
- Regulatory and compliance risk (Correct answer)
- Operational availability risk
- Vendor concentration risk
Correct answer: Regulatory and compliance risk
Unauthorized data residency can violate data sovereignty laws (e.g., GDPR, CCPA), directly creating regulatory and compliance exposure.
Question 7: The Right to Audit clause in a vendor contract primarily serves to:
- Allow the vendor to audit the client's systems for compliance
- Grant the organization the ability to examine the vendor's controls and records (Correct answer)
- Establish financial penalties for service outages
- Define the vendor's liability cap for data breaches
Correct answer: Grant the organization the ability to examine the vendor's controls and records
A Right to Audit clause gives the contracting organization (or its designee) the authority to review the vendor's security controls, processes, and records.
GRC Third-Party Risk Management 2
Which document establishes the specific security and compliance requirements a vendor must meet as part of a contract?