CCB Third-Party & Vendor Risk Management 1 — Questions and Answers
Question 1: Which of the following best describes the primary purpose of a third-party risk management (TPRM) program in a compliance context?
- To negotiate lower contract prices with vendors
- To identify, assess, and mitigate risks posed by external parties that have access to company data, systems, or operations (Correct answer)
- To eliminate the use of all external vendors wherever possible
- To transfer all liability for compliance failures to third-party vendors
Correct answer: To identify, assess, and mitigate risks posed by external parties that have access to company data, systems, or operations
A TPRM program is designed to systematically identify, assess, and mitigate the compliance, operational, and reputational risks that arise when third parties have access to an organization's data, systems, or business operations.
Question 2: During vendor onboarding, a compliance officer conducts a due diligence review. Which document is MOST critical for assessing a vendor's own compliance posture?
- The vendor's marketing brochure
- The vendor's SOC 2 Type II report or equivalent third-party audit report (Correct answer)
- The vendor's annual revenue statements
- The vendor's employee headcount data
Correct answer: The vendor's SOC 2 Type II report or equivalent third-party audit report
A SOC 2 Type II report (or equivalent independent audit) provides verified evidence of a vendor's security, availability, and processing integrity controls over a period of time, making it the most relevant document for assessing compliance posture.
Question 3: What is 'fourth-party risk' in the context of vendor risk management?
- Risk arising from the organization's own fourth business unit
- Risk posed by the subcontractors and service providers used by your direct vendors (Correct answer)
- Risk from the fourth year of a vendor contract
- Regulatory risk from the fourth regulatory body overseeing the vendor
Correct answer: Risk posed by the subcontractors and service providers used by your direct vendors
Fourth-party risk refers to the risk exposure that arises from the subcontractors, suppliers, and service providers that your direct (third-party) vendors rely upon, extending the risk chain beyond your immediate contractual relationships.
Question 4: Which approach to vendor risk tiering is considered best practice?
- Treating all vendors equally with the same level of scrutiny
- Categorizing vendors by risk level (e.g., critical, high, medium, low) based on data access, criticality, and regulatory exposure (Correct answer)
- Applying the most rigorous controls only to domestic vendors
- Tiering vendors solely by contract dollar value
Correct answer: Categorizing vendors by risk level (e.g., critical, high, medium, low) based on data access, criticality, and regulatory exposure
Risk-based tiering categorizes vendors according to their potential impact on the organization (considering data sensitivity, operational criticality, and regulatory exposure), allowing compliance resources to be focused where risk is greatest.
Question 5: Under the OCC's third-party risk management guidance, which lifecycle stage requires the MOST ongoing monitoring activities?
- Planning
- Due diligence and vendor selection
- Ongoing monitoring during the contract term (Correct answer)
- Contract negotiation
Correct answer: Ongoing monitoring during the contract term
The OCC guidance emphasizes that ongoing monitoring throughout the life of the third-party relationship is critical, requiring continuous performance reviews, periodic reassessments, and incident tracking to manage risk effectively.
Question 6: A compliance officer discovers that a critical vendor has suffered a data breach. What should be the FIRST action taken?
- Immediately terminate the vendor contract
- Activate the organization's incident response and breach notification protocols and assess the scope of exposure (Correct answer)
- Wait 30 days to see if the vendor resolves the breach on its own
- Publicly announce the breach on behalf of the vendor
Correct answer: Activate the organization's incident response and breach notification protocols and assess the scope of exposure
The immediate priority is to activate incident response protocols, assess the scope of the organization's exposure, and fulfill any applicable breach notification obligations, which may be time-sensitive under laws like GDPR or state breach notification statutes.
Question 7: Which contractual provision is MOST important for ensuring a vendor remains compliant with applicable laws and regulations throughout the contract term?
- A fixed-price payment clause
- A representations and warranties clause combined with a right-to-audit provision (Correct answer)
- A limitation of liability cap set at $1,000
- An automatic renewal clause
Correct answer: A representations and warranties clause combined with a right-to-audit provision
Representations and warranties require vendors to attest to their compliance status, while right-to-audit provisions give the organization the contractual ability to verify compliance, together forming the strongest contractual compliance safeguard.
