Which elements are core steps in vendor risk management within governance?

• A. Exit/transition planning and ongoing monitoring.
• B. Only initial contracting.
• C. Relying on vendor self-assessments.
• D. Ignoring contract terms after signing.

Answer: (A)

In governance, managing vendor risk is a lifecycle that relies on proactive planning for disengagement and active oversight throughout the relationship. Exit or transition planning ensures you can exit a vendor smoothly if performance falters, costs rise beyond control, or strategic priorities change. It covers data handover, revocation of access, contract terminations, knowledge transfer, and a clear transition timeline so operations aren’t disrupted. Ongoing monitoring keeps risk from slipping as conditions change—regularly checking vendor performance, security controls, regulatory compliance, contract terms, and any changes in the vendor’s financial or operational posture, and prompting remediation when gaps appear.

Relying only on initial contracting misses how risk evolves after the deal is signed, and focusing on vendor self-assessments alone risks biased or incomplete information. Ignoring contract terms after signing dismantles governance and accountability.