What is third-party risk management, and what governance controls ensure ethical behavior by vendors and partners?

• A. Managing risk from suppliers and partners; require due diligence, contracts with ethics clauses, monitoring, audits, and whistleblower access.
• B. Only monitor suppliers, no due diligence.
• C. Rely solely on price competition.
• D. Forbid whistleblower access.

Answer: (A)

Third-party risk management covers identifying and mitigating the risks that come from doing business with external vendors and partners. It’s not just about price or service quality; it’s about ensuring these relationships don’t introduce compliance, operational, or reputational risks. The governance controls that help ensure ethical behavior by vendors and partners include doing due diligence before onboarding to assess integrity, compliance history, and risk posture; embedding ethics clauses and contractual obligations that require adherence to laws, policies, and ethical standards; ongoing monitoring and audits to verify that practices align with those expectations; and providing whistleblower channels so concerns can be reported and investigated safely. Together, these elements create accountability and ongoing oversight over third parties, reducing the chance that unethical behavior slips through. Other options fall short because they either skip upfront due diligence, rely only on price competition, or remove essential reporting channels for misconduct.