Third-Party and Supply Chain Risk CRISC Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A company's supply chain includes multiple tiers of suppliers, some of which are not directly contracted. A risk assessment reveals that a second-tier supplier has poor labor practices, which could lead to reputational damage. The company has limited ability to influence this supplier. What is the BEST course of action?

   • AAccept the risk because the second-tier supplier is not directly contracted.
   • BEngage with the direct supplier to require the second-tier supplier to comply with the company's code of conduct.
   • CPublicly disclose the second-tier supplier's practices to pressure them to change.
   • DTerminate the relationship with the direct supplier to avoid association with the second-tier supplier.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the primary purpose of a vendor risk management framework?

   • ATo guarantee that vendors never fail to deliver
   • BTo replace the need for vendor contracts
   • CTo ensure vendors are paid on time
   • DTo systematically manage risks associated with third-party relationships
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which of the following is a component of vendor due diligence?

   • AReviewing the vendor's compliance history
   • BCreating marketing materials
   • CSetting up the vendor's software
   • DTraining vendor staff
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the primary objective of vendor termination and exit management?

   • ATo extend the contract
   • BTo reduce costs
   • CTo minimize risk and ensure a smooth transition
   • DTo maximize vendor profits
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A financial services firm is evaluating a new vendor that will process customer loan applications, including sensitive personal data. The vendor is a startup with limited operating history but strong technical references. The firm's risk appetite allows for moderate risk if mitigated. What should the risk practitioner do FIRST?

   • AAccept the risk because the vendor has strong technical references.
   • BRequire the vendor to obtain a SOC 2 report before any further discussions.
   • CTerminate the relationship because the vendor is a startup with limited history.
   • DConduct a detailed vendor risk assessment focusing on data sensitivity and criticality, including a review of the vendor's security controls and financial stability.
   Reveal Solution Discussion Select an answer first