Answer-first summary for fast verification
Answer: The bank should review all third-party audit reports of the vendor that are publicly available.
The correct answer is A. The bank should review all third-party audit reports of the vendor that are publicly available. This is in line with the guidelines regarding internal controls, which state that for significant service provider relationships, financial institutions should assess the adequacy of the provider's control environment. This assessment includes reviewing available audits or reports, such as the American Institute of Certified Public Accountants' Service Organization Control 2 report. Option B is incorrect because the bank should review the vendor's incentive compensation structure to ensure it does not encourage sales representatives to promote higher margin products without considering the associated risk to the customers. Option C is incorrect as well. Outsourcing critical processes is not prohibited; a community banking organization may outsource critical business activities to a few reputable service providers, and larger financial institutions may use numerous service providers for various business activities with material risk. Option D is also incorrect. The bank should monitor the vendor's contingency planning process and assess the adequacy and effectiveness of the vendor's disaster recovery and business continuity plan, ensuring it aligns with the bank's own plan, rather than being responsible for developing the vendor's process.
Author: LeetQuiz Editorial Team
Ultimate access to all questions.
When developing guidelines to manage operational risks in a potential vendor agreement, which recommendation would be the most appropriate for the committee to contemplate when assessing a third-party vendor's involvement in marketing the bank's financial products to prospective clients?
A
The bank should review all third-party audit reports of the vendor that are publicly available.
B
The bank should ensure that the vendor's sales representatives are compensated mainly with commissions from the sale of the bank's products
C
The bank should prevent the third-party vendor from having access to any of its critical processes.
D
The bank should be responsible for developing the vendor's contingency planning process to mitigate risk exposure to the vendor.
No comments yet.