CCB Third-Party & Vendor Risk Management

Question 1

Which of the following best describes the primary purpose of a third-party risk management (TPRM) program in a compliance context?

Accepted Answer

To identify, assess, and mitigate risks posed by external parties that have access to company data, systems, or operations

Answer

To negotiate lower contract prices with vendors

Answer

To eliminate the use of all external vendors wherever possible

Answer

To transfer all liability for compliance failures to third-party vendors

Question 2

During vendor onboarding, a compliance officer conducts a due diligence review. Which document is MOST critical for assessing a vendor's own compliance posture?

Accepted Answer

The vendor's SOC 2 Type II report or equivalent third-party audit report

Answer

The vendor's marketing brochure

Answer

The vendor's annual revenue statements

Answer

The vendor's employee headcount data

Question 3

What is 'fourth-party risk' in the context of vendor risk management?

Accepted Answer

Risk posed by the subcontractors and service providers used by your direct vendors

Answer

Risk arising from the organization's own fourth business unit

Answer

Risk from the fourth year of a vendor contract

Answer

Regulatory risk from the fourth regulatory body overseeing the vendor

Question 4

Which approach to vendor risk tiering is considered best practice?

Accepted Answer

Categorizing vendors by risk level (e.g., critical, high, medium, low) based on data access, criticality, and regulatory exposure

Answer

Treating all vendors equally with the same level of scrutiny

Answer

Applying the most rigorous controls only to domestic vendors

Answer

Tiering vendors solely by contract dollar value

Question 5

Under the OCC's third-party risk management guidance, which lifecycle stage requires the MOST ongoing monitoring activities?

Accepted Answer

Ongoing monitoring during the contract term

Answer

Planning

Answer

Due diligence and vendor selection

Answer

Contract negotiation

Question 6

A compliance officer discovers that a critical vendor has suffered a data breach. What should be the FIRST action taken?

Accepted Answer

Activate the organization's incident response and breach notification protocols and assess the scope of exposure

Answer

Immediately terminate the vendor contract

Answer

Wait 30 days to see if the vendor resolves the breach on its own

Answer

Publicly announce the breach on behalf of the vendor

Question 7

Which contractual provision is MOST important for ensuring a vendor remains compliant with applicable laws and regulations throughout the contract term?

Accepted Answer

A representations and warranties clause combined with a right-to-audit provision

Answer

A fixed-price payment clause

Answer

A limitation of liability cap set at $1,000

Answer

An automatic renewal clause