DPI Practice Question: An organization is evaluating its vendor risk management process using the 'Optimize and…
An organization is evaluating its vendor risk management process using the 'Optimize and automate' guiding principle. Manual spreadsheet tracking of third-party compliance certificates has led to missed renewals. Which tool configuration best applies this principle?
⚠ Common exam trap
Watch out — candidates often confuse 'optimize and automate' with simply reducing effort or cost, leading candidates to choose options that either replace one manual tool with another (A) or add manual labor (B), rather than implementing true automation that addresses the root cause.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement an automated vendor risk portal with automated alerting for certificate expirations and integrated scoring.
The 'Optimize and automate' guiding principle in DPI (Digital and Process Innovation) emphasizes using technology to streamline and automate repetitive, error-prone tasks. An automated vendor risk portal with alerting and integrated scoring directly applies this by replacing manual spreadsheet tracking with automated certificate expiration alerts and continuous risk scoring, reducing missed renewals and human error. This aligns with the principle's goal of improving efficiency, accuracy, and scalability in vendor risk management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Switch from Excel spreadsheets to a shared Microsoft Word document.
Why it's wrong here
A shared Word document retains manual entry and human tracking, so missed renewals persist; it merely relocates the spreadsheet without adding scheduling or alerting. Optimize and automate requires tooling that records expiry dates and notifies owners automatically. Word suits narrative policy documents, not structured certificate lifecycle tracking with date-driven reminders.
- ✗
Hire two additional compliance analysts to manually check spreadsheets daily.
Why it's wrong here
Adding headcount preserves the manual spreadsheet process, so renewals still depend on human checking and remain prone to being missed. The Optimize and automate principle calls for tooling that schedules and triggers certificate renewal alerts automatically. Manual analysts would fit only where judgement cannot be codified, such as adjudicating ambiguous contractual risk.
- ✓
Implement an automated vendor risk portal with automated alerting for certificate expirations and integrated scoring.
Why this is correct
An automated vendor risk portal records each certificate with its expiry date, alerts owners well ahead of renewal, escalates if nothing happens, and scores vendors consistently, removing the manual checking that caused missed renewals. That is the 'optimise and automate' principle: simplify the process, then automate the repetitive, rule-based parts, so people focus on judgement work such as assessing high-risk suppliers.
- ✗
Eliminate vendor risk reviews to speed up procurement.
Why it's wrong here
Removing vendor reviews takes away a control rather than improving it, leaving third-party compliance unchecked and raising supply chain risk. 'Optimise and automate' is about doing necessary work more efficiently and reliably, not deleting it. Speeding procurement at the expense of risk management also conflicts with the principle of focusing on value for the organisation.
About these practice questions
This DPI question is part of Courseiva's 313-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
You might also like
Similar DPI questions
- An IT governance board is evaluating how to apply 'Optimize and automate' to its vendor risk assessment process. Which T…
- An organization is launching a new DevOps pipeline and wants to ensure that all team members feel psychological safety a…
- An IT organization is embedding the ITIL 4 guiding principle 'Collaborate and promote visibility' into its GRC practices…
- A multinational corporation is consolidating its regional GRC tools into a single global instance of ServiceNow GRC. The…
- An enterprise is deploying a Zero Trust Architecture (ZTA). Rather than restricting access based solely on corporate net…
Written and reviewed by Johnson Ajibi, MSc IT Security
Security Systems Architect · founder of Courseiva
Last reviewed September 2026 · checked against the official AXELOS / PeopleCert exam blueprint
This DPI practice question is part of Courseiva's free AXELOS / PeopleCert certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DPI exam.