Risk Assessment and Treatment describes which aspects of a vendor's program?

• A. The vendor's risk assessment program, and its maturity and operating effectiveness
• B. The vendor's financial stability
• C. The vendor's marketing strategy
• D. The vendor's geographic location

Answer: (A)

Risk assessment and treatment focuses on how a vendor identifies and evaluates risks and how those risks are addressed through controls and actions. The best answer specifies the vendor's risk assessment program itself, including how mature that program is and whether its controls are operating effectively. This directly describes the structure, capability, and performance of the vendor’s risk management activities. Financial stability, marketing strategy, or geographic location are not about the risk assessment process or its effectiveness, so they don’t fit this concept.