mediumMultiple ChoiceObjective-mapped
CRISC Practice Question: A company outsourced its payroll processing to a…
A company outsourced its payroll processing to a third-party vendor. During the risk assessment, it was found that the vendor's data centers are in a country with weak data protection laws. What is the BEST way to treat this risk?
⚠ Common exam trap
It's easy for candidates to confuse risk treatment options—mistaking risk transfer (insurance) or risk avoidance (termination) for the most appropriate response, when the question specifically asks for the 'best way to treat' a risk that can be mitigated through contractual and compliance controls.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Require contractual clauses and verify compliance
The best way to treat this risk is to implement contractual controls that require the vendor to adhere to data protection standards equivalent to the company's requirements, and to verify compliance through audits or certifications. This directly addresses the root cause—weak local data protection laws—by imposing enforceable obligations on the vendor, rather than transferring, avoiding, or accepting the risk without mitigation. Contractual clauses with compliance verification are a recognized risk mitigation technique in third-party risk management, as they create a legal framework for data protection regardless of the vendor's jurisdiction.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Terminate the contract and bring payroll in-house
Why it's wrong here
May be too disruptive and costly; risk can be managed with controls.
- ✗
Purchase cyber insurance to cover potential losses
Why it's wrong here
Insurance transfers financial risk but does not reduce the likelihood or impact of data loss.
- ✓
Require contractual clauses and verify compliance
Why this is correct
Contractual obligations with verification help manage the risk while maintaining operations.
- ✗
Accept the risk because the vendor has never had a breach
Why it's wrong here
Acceptance should be based on residual risk within appetite, not lack of incidents.
Go deeper
Related to this question
About these practice questions
One of 983 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.