Virtual assessment allows which of the following to verify vendor responses?

• A. Independent audits or reporting
• B. Purely questionnaire responses
• C. Only site visits
• D. None of the above

Answer: (A)

Virtual assessment hinges on evidence sourced from independent, third‑party evaluations rather than self-proclaimed answers. Independent audits or reporting provide objective verification of a vendor’s controls and their effectiveness. This means you can review external documents—such as SOC 2 reports, ISO 27001 certifications, PCI DSS attestations, or other third‑party audit findings—remotely to confirm what the vendor claims. Purely questionnaire responses are self‑reported and can be biased or incomplete, so they don’t offer the same level of validation. Site visits aren’t the only method in a virtual approach, since you can rely on remote access to these independent documents and evidence. Thus, independent audits or reporting best fulfill the need to verify vendor responses in a virtual assessment.