What are the core steps in vendor risk management within governance?

• A. Risk assessment of vendors, contract controls, security/privacy requirements, ongoing monitoring, and exit/transition planning.
• B. Only signing the cheapest contract.
• C. Ignoring vendor performance after procurement.
• D. Relying solely on vendor self-assessments.

Answer: (A)

Vendor risk management in governance relies on a lifecycle approach to third‑party relationships. The strongest sequence covers identifying and assessing each vendor’s risk, establishing contract controls, monitoring risk continually, and planning for a safe exit or transition. Start with a thorough risk assessment to understand data sensitivity, access needs, regulatory obligations, and the potential impact of the vendor on operations. Then put contract controls in place that require specific security and privacy measures, clear data handling rules, defined responsibilities, liability terms, and audit rights so expectations are enforceable. Next, maintain ongoing monitoring to track performance, security posture, compliance with contract terms, incident response readiness, and changes in risk over time. Finally, have a well-defined exit or transition plan to ensure data is returned or destroyed securely, continuity of service is maintained, and knowledge is transferred smoothly at disengagement. This integrated approach ensures risks are identified, contractual obligations enforceable, security and privacy requirements are upheld, and disengagement is managed without disruption. In contrast, choosing the cheapest contract ignores risk, neglecting vendor performance leaves issues unresolved, and relying only on vendor self‑assessments can give biased or incomplete information.