Third-Party Risk Assessment and Due Diligence Flashcards

Which document is most commonly used as the foundation for third-party risk assessments in the US financial sector?

Answer: Standardized Information Gathering (SIG) questionnaire

The SIG questionnaire, developed by Shared Assessments, is the industry standard tool for gathering third-party risk information in the financial and other regulated sectors.

What is the primary purpose of inherent risk scoring during vendor due diligence?

Answer: To prioritize vendors by potential risk before controls are considered

Inherent risk scoring evaluates the risk a third party poses based on the nature of the engagement, independent of any controls the vendor may have in place.

During onboarding due diligence, which factor most increases a vendor's risk tier?

Answer: Access to sensitive customer data or critical systems

Access to sensitive data or critical systems is the primary driver for escalating a vendor to a higher risk tier requiring more rigorous due diligence.

What is a 'fourth-party risk' in the context of third-party risk management?

Answer: Risk posed by your vendor's subcontractors or suppliers

Fourth-party risk refers to the risk exposure that arises from the subcontractors and service providers used by your direct (third-party) vendors.

Which assessment type involves an on-site visit to the vendor's facilities to verify controls firsthand?

Answer: On-site assessment

An on-site assessment allows the assessing organization to directly observe and verify the vendor's operational controls and physical security measures.

In the CTPRP framework, what does 'residual risk' mean after vendor controls are evaluated?

Answer: The remaining risk after accounting for the vendor's controls and mitigations

Residual risk is the level of risk that remains after the vendor's existing controls and mitigations have been evaluated and credited.