Third-Party and Vendor Compliance Management Flashcards
7 cards from real CCM practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Third-Party and Vendor Compliance Management flashcards as text
What is 'vendor tiering' in the context of third-party risk management?
Answer: Classifying vendors into risk levels to allocate due diligence and monitoring resources proportionally
Vendor tiering assigns risk levels (e.g., critical, high, medium, low) based on factors such as data access, regulatory impact, and financial exposure, enabling the organization to focus compliance resources where risk is greatest.
Which of the following is a significant red flag during third-party due diligence that should trigger enhanced scrutiny?
Answer: The vendor declines to disclose ownership structure or beneficial owners
Refusal to disclose ownership or beneficial owners raises anti-money laundering, sanctions, and corruption concerns, and is a classic red flag requiring enhanced due diligence.
What key element must be included in a vendor contract to support ongoing compliance oversight?
Answer: Compliance obligations, reporting requirements, and rights to terminate for non-compliance
Effective vendor contracts must specify the compliance standards the vendor must meet, how they must report compliance issues, and the organization's right to terminate if those standards are not upheld.
How frequently should a compliance manager reassess a high-risk critical vendor relationship?
Answer: At least annually, and upon any material change
High-risk vendors require at least annual reassessment, plus reviews triggered by material events such as data breaches, ownership changes, or regulatory actions, to ensure ongoing compliance alignment.
What is the primary purpose of a vendor code of conduct?
Answer: To define ethical and legal behavior standards that vendors must follow to do business with the organization
A vendor code of conduct communicates the ethical, legal, and compliance standards the organization expects all vendors to uphold, extending the organization's compliance culture to its supply chain.
What does 'concentration risk' mean in the context of third-party compliance management?
Answer: The risk of over-reliance on a single vendor or small group of vendors for critical functions
Concentration risk occurs when an organization depends heavily on one or a few vendors for critical services, meaning a failure or non-compliance event at that vendor could have an outsized impact on the organization.
Under the GDPR, when a company shares personal data with a third-party vendor that processes data on its behalf, the vendor is classified as:
Answer: A data processor subject to binding contractual data protection requirements
Under GDPR, a vendor processing personal data on behalf of another organization is a data processor, and the controller must establish a Data Processing Agreement (DPA) outlining the processor's obligations.