Risk Reporting, Governance, and Program Management Flashcards

Which body within an organization typically has ULTIMATE accountability for the third-party risk management program?

Answer: The Board of Directors or a delegated committee such as the Risk Committee

Governance accountability for enterprise risk programs — including TPRM — rests at the Board or its delegated committee (e.g., Audit and Risk Committee). The Board sets risk appetite and expects management to report on TPRM program effectiveness. Procurement, IT, and business lines have operational roles, but ultimate accountability is at the governance level.

A 'risk appetite statement' in the context of third-party risk management defines:

Answer: The level and types of vendor-related risk the organization is willing to accept in pursuit of its objectives

A risk appetite statement articulates how much and what kinds of third-party risk the organization is prepared to tolerate. It guides decisions such as which vendor tiers receive enhanced due diligence, when to reject a vendor despite business pressure, and how aggressively to pursue remediation. It is a governance document, not a procurement threshold or SLA benchmark.

Which metric would be MOST useful to include in a quarterly TPRM dashboard presented to senior management?

Answer: The number of high-risk vendors with overdue remediation items

Senior leadership needs actionable risk intelligence. The number of high-risk vendors with overdue remediation items is a direct indicator of unresolved risk exposure that may require executive escalation or resource allocation. Analyst tenure, invoice volumes, and vendor employee satisfaction do not convey meaningful risk posture to a risk dashboard audience.

The 'offboarding' phase of the vendor lifecycle is important to third-party risk management primarily because:

Answer: It ensures the organization's data is returned or destroyed and access is revoked when a vendor relationship ends

Offboarding is a critical risk control point. When a vendor relationship ends, the organization must ensure all data (including sensitive customer or proprietary data) is securely returned or destroyed per contractual and regulatory requirements, and that all system access credentials are revoked. Failure to manage offboarding can leave data exposed or former vendors with ongoing access.

An organization uses a tiered vendor classification system (e.g., Tier 1 = Critical, Tier 2 = High, Tier 3 = Low). What is the PRIMARY benefit of this approach?

Answer: It allows TPRM resources and controls to be proportionally allocated based on the risk each vendor presents

Tiering allows risk-proportionate resource allocation — applying more rigorous (and expensive) due diligence, more frequent monitoring, and stronger contractual protections to vendors that present greater risk. Applying the same level of scrutiny to every vendor would be impractical and inefficient. Tiering is a foundational TPRM program design decision, not primarily a procurement or compliance mechanism.

When a business unit 'inherits' responsibility for a vendor previously managed by another team, which step is MOST critical from a TPRM perspective?

Answer: Verifying the vendor's current risk assessment is up to date and transferring formal risk ownership

When vendor relationship ownership transfers, the TPRM program must ensure that risk ownership — and accountability for monitoring and remediation — formally transfers as well. The incoming team must confirm the vendor's risk documentation is current and that they understand any open issues. Without this handoff, vendors can fall into monitoring gaps.