Explanation:
To mitigate operational and information security risks, a bank should restrict a marketing vendor's access to its critical processes and systems following the principle of least privilege. A marketing vendor does not require access to core banking operations or critical processes to perform its duties. Option A is incorrect because third-party audit reports (such as SOC 1 or SOC 2 reports) are typically highly confidential and not publicly available; the bank should request these directly under a non-disclosure agreement. Option B is incorrect as compensating solely based on commissions significantly increases conduct risk and the potential for mis-selling. Option D is incorrect because the vendor must be responsible for developing and maintaining its own contingency planning and business continuity processes, while the bank's role is to assess and review them.
A
The bank should review all third-party audit reports of the vendor, which are publicly available.
B
The bank should ensure that the vendor's sales representatives are compensated mainly with commissions from the sale of the bank's products.
C
The bank should prevent the third-party vendor from having access to any of its critical processes.
D
The bank should be responsible for developing the vendor's contingency planning process to mitigate risk exposure to the vendor.
No comments yet.