CCB Third-Party & Vendor Risk Management 3

Question 1

What is the purpose of a vendor exit strategy or termination plan in third-party risk management?

Accepted Answer

To ensure the organization can transition services, retrieve data, and maintain business continuity if a vendor relationship is terminated, whether planned or abrupt

Answer

To help vendors find new clients when their contract ends

Answer

To allow vendors to exit the contract without penalties

Answer

To document reasons for extending a vendor's contract

Question 2

Which metric is MOST useful for tracking the effectiveness of a third-party risk management program?

Accepted Answer

The percentage of vendors that have completed required risk assessments and remediated identified gaps within defined timeframes

Answer

The total number of vendors under contract

Answer

The average cost of vendor contracts

Answer

The number of vendor invoices processed per month

Question 3

Which of the following best describes 'vendor offboarding' from a compliance perspective?

Accepted Answer

The structured process of terminating a vendor relationship that includes revoking access, retrieving or destroying data, ensuring contract obligations are met, and documenting the closure

Answer

The process of training new vendor employees

Answer

The process of adding a vendor to the approved vendor list

Answer

The financial settlement of outstanding vendor invoices only

Question 4

Anti-bribery and corruption (ABC) due diligence on third parties is MOST important when:

Accepted Answer

The vendor acts as an agent, distributor, or intermediary that interacts with government officials on the organization's behalf

Answer

The vendor supplies only office furniture

Answer

The vendor is a publicly traded company

Answer

The vendor is headquartered in the same country as the organization

Question 5

What is the role of a 'vendor risk register' in third-party risk management?

Accepted Answer

A centralized record that documents all identified third-party risks, their severity, mitigation actions, owners, and status, serving as the master tracking tool for the TPRM program

Answer

A list of vendors who have been blacklisted from future business

Answer

A financial ledger of all vendor payments

Answer

A directory of vendor contact information only

Question 6

When a vendor undergoes a material change such as a merger, acquisition, or ownership change, the compliance team should FIRST:

Accepted Answer

Conduct a reassessment of the vendor's risk profile to determine whether the change affects the organization's risk exposure or contractual rights

Answer

Automatically terminate the vendor contract

Answer

Ignore the change until the next scheduled review

Answer

Renegotiate pricing immediately

Question 7

Which of the following best describes the 'residual risk' concept in third-party vendor risk management?

Accepted Answer

The risk that remains after all available controls, mitigations, and countermeasures have been applied to a third-party relationship

Answer

The amount of risk that existed before the vendor relationship began

Answer

The financial cost remaining after vendor payments are processed

Answer

The risk that a vendor will submit residual invoices after contract termination