CRISC Risk Response and Reporting Practice Question
A financial services company is implementing a vendor risk management program. Which THREE of the following are key components of an effective vendor risk assessment process? (Select THREE)
⚠ Common exam trap
Candidates often confuse risk transfer mechanisms (like cyber insurance) with risk assessment activities, leading them to select option C, when in fact insurance does not evaluate the vendor's actual security posture or operational risk.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Contract compliance reviews
Contract compliance reviews (A) are a key component because they verify that vendors are meeting agreed-upon service level agreements (SLAs), security clauses, and regulatory requirements. This ensures that contractual obligations, such as data protection standards and incident response timelines, are being enforced and that any deviations are identified and remediated. Without this review, the organization cannot confirm that the vendor's actual practices align with the risk posture agreed upon during onboarding.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Contract compliance reviews
Why this is correct
Ensuring vendors meet contractual security requirements is essential.
- ✓
Ongoing monitoring via annual reassessments
Why this is correct
Continuous or periodic monitoring ensures risk posture is maintained.
- ✗
Review of vendor's cyber insurance policy
Why it's wrong here
Insurance is a transfer mechanism, not a core component of risk assessment.
- ✓
Initial onboarding assessment including security questionnaires
Why this is correct
Onboarding assessment is critical to evaluate risks before engagement.
- ✗
Vendor self-assessment without validation
Why it's wrong here
Self-assessment without validation may be unreliable.
Go deeper
Related to this question
About these practice questions
One of 983 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.