Spot the Red Flag

Read the scenario. Identify the compliance red flags. How sharp are your instincts?

Day 123 Bonus Challenge Vendor Risk Easy

Share this page:

Educational Tool Only. This tool is provided for educational and informational purposes and does not constitute legal, regulatory, or professional advice. Results should not be used as the sole basis for any compliance or business decision.

No Guarantee of Accuracy. While this tool is based on recognised regulatory frameworks, LexFlag does not guarantee the accuracy, completeness, or currency of the results. Regulations change frequently and may vary by jurisdiction.

Independent Verification Required. You should consult qualified professionals and independently verify any results before making any decisions. LexFlag and its affiliates accept no liability for any loss or damage arising from the use of this tool.

The Scenario

Your procurement team is reviewing the vendor portfolio for critical IT infrastructure. Apex Cloud Solutions provides 100% of your company's cloud hosting, email, and backup services under a single contract worth $1.4 million annually. The contract has been auto-renewed for five years without a competitive review. Apex recently lost two major clients and had its credit rating downgraded to BB-. There are no documented disaster recovery provisions if Apex fails. Apex's CEO is a college friend of your company's CTO.

Which of these are red flags?

Select all that you think are compliance red flags, then submit.

100% dependency on a single cloud provider

Total dependency on one vendor for critical infrastructure creates catastrophic business continuity risk if that vendor fails.

Vendor's credit rating downgraded to BB-

A credit downgrade signals financial instability, increasing the risk that the vendor may default on its service commitments.

Five years of auto-renewal without competitive review

Lack of periodic competitive review prevents price benchmarking and quality assessment, and may indicate complacency or conflicts of interest.

The vendor provides cloud, email, and backup services

Bundled IT services from one provider is common. The risk is concentration, not the service types.

No documented disaster recovery plan

Missing DR provisions for critical infrastructure mean no fallback if the vendor experiences an outage or goes out of business.

The contract is worth $1.4 million annually

The contract value itself is not a red flag. Many companies spend this amount or more on cloud infrastructure.

Vendor's CEO is friends with your company's CTO

A personal relationship between key decision-makers creates a conflict of interest that may have influenced the lack of competitive review.

Want unlimited challenges? Sign up for free.

Create Free Account

Try also — Compliance Stack

All games

Want the real tools?

Screen real entities against global watchlists, risk databases, and compliance sources.

Start Free Trial