Third-Party and Supply Chain Risk CRISC Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A global company sources components from a supplier in a country with strict data localization laws. The supplier will process personal data of the company's customers. The company's legal team is concerned about compliance. What is the PRIMARY risk to address?

   • AReputational risk due to the supplier's location.
   • BOperational risk due to potential supply chain disruptions.
   • CFinancial risk due to currency fluctuations.
   • DCompliance risk due to potential violation of data residency and transfer regulations.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A company has a vendor risk management framework that includes annual assessments for all vendors. However, a critical vendor recently underwent a major merger, and the company is concerned about changes in the vendor's operations. What should the risk practitioner do?

   • AConduct an ad-hoc risk assessment of the vendor to evaluate the impact of the merger.
   • BAsk the vendor to provide a self-assessment of the merger's impact.
   • CWait for the annual assessment to see if the merger has any impact.
   • DTerminate the contract with the vendor due to the uncertainty.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A healthcare organization is considering a vendor that will handle protected health information (PHI). The vendor is a large, well-established company but has had a recent compliance violation. What should the organization do during due diligence?

   • AReview the vendor's compliance history, including the details of the violation and corrective actions taken.
   • BRequire the vendor to sign a contract stating they will not violate regulations in the future.
   • CIgnore the violation because the vendor is large and well-established.
   • DAccept the risk because the vendor is the only one that can provide the service.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company's supply chain includes a supplier that uses a sub-tier supplier for a critical component. The sub-tier supplier is located in a region with a high risk of natural disasters. What should the company do to manage this risk?

   • AIgnore the risk because the sub-tier supplier is not directly contracted.
   • BAccept the risk because natural disasters are unpredictable.
   • CTerminate the relationship with the direct supplier to avoid the risk.
   • DAssess the risk of the sub-tier supplier and require the direct supplier to have contingency plans for disruptions.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which of the following is a key activity in vendor exit management?

   • AEnsuring the return of data and assets
   • BConducting due diligence
   • CSetting performance metrics
   • DSigning a new contract
   Reveal Solution Discussion Select an answer first