CCM Third-Party and Vendor Compliance Management 2

Question 1

What is 'vendor tiering' in the context of third-party risk management?

Accepted Answer

Classifying vendors into risk levels to allocate due diligence and monitoring resources proportionally

Answer

Ranking vendors by the length of their contracts

Answer

Categorizing vendors by their geographic location

Answer

Sorting vendors alphabetically for administrative ease

Question 2

Which of the following is a significant red flag during third-party due diligence that should trigger enhanced scrutiny?

Accepted Answer

The vendor declines to disclose ownership structure or beneficial owners

Answer

The vendor uses a well-known cloud service provider

Answer

The vendor has ISO 27001 certification

Answer

The vendor has been in operation for more than ten years

Question 3

What key element must be included in a vendor contract to support ongoing compliance oversight?

Accepted Answer

Compliance obligations, reporting requirements, and rights to terminate for non-compliance

Answer

A clause limiting vendor liability to zero

Answer

A guarantee that vendor pricing will never increase

Answer

A clause waiving all regulatory requirements

Question 4

How frequently should a compliance manager reassess a high-risk critical vendor relationship?

Accepted Answer

At least annually, and upon any material change

Answer

Only at contract renewal

Answer

Every five years

Answer

Only when a regulatory examination is scheduled

Question 5

What is the primary purpose of a vendor code of conduct?

Accepted Answer

To define ethical and legal behavior standards that vendors must follow to do business with the organization

Answer

To limit the vendor's ability to work with competitors

Answer

To set pricing benchmarks for vendor services

Answer

To provide vendors with the organization's trade secrets

Question 6

What does 'concentration risk' mean in the context of third-party compliance management?

Accepted Answer

The risk of over-reliance on a single vendor or small group of vendors for critical functions

Answer

The risk that a vendor concentrates too many employees in one location

Answer

The risk that compliance staff are focused on too many projects simultaneously

Answer

The risk that vendor contracts are concentrated in a single legal jurisdiction

Question 7

Under the GDPR, when a company shares personal data with a third-party vendor that processes data on its behalf, the vendor is classified as:

Accepted Answer

A data processor subject to binding contractual data protection requirements

Answer

A data controller with independent obligations

Answer

A data subject with rights under the regulation

Answer

A supervisory authority responsible for enforcement