Third-Party Risk Assessment and Due Diligence Flashcards

A financial institution is onboarding a cloud-based payroll processor that will access employee PII. Which due diligence artifact is MOST critical to obtain before contract execution?

Answer: SOC 2 Type II report covering the prior 12-month period

A SOC 2 Type II report provides independent, audited evidence of operational effectiveness of security controls over a meaningful period, directly relevant to PII handling.

During inherent risk tiering, which combination of factors most commonly elevates a vendor to 'Critical' tier?

Answer: High data sensitivity, deep system integration, and no viable substitutes

Critical tier designation typically results from the convergence of sensitive data exposure, deep technical integration, and concentration risk from lack of substitutes.

An organization discovers mid-assessment that a Tier 1 vendor subcontracts 60% of its core service delivery to an unnamed fourth party. What is the BEST immediate response?

Answer: Require disclosure of fourth-party identities and extend due diligence to cover material subcontractors

Material fourth-party exposure must be identified and assessed; requiring disclosure and extending due diligence preserves visibility into the full risk chain.

Which assessment methodology is specifically designed to evaluate a third party's resilience and ability to continue services during a major disruption?

Answer: Business continuity and disaster recovery (BC/DR) assessment

BC/DR assessments test whether a vendor has tested recovery plans, defined RTOs/RPOs, and can sustain service delivery through outages or disasters.

A procurement team bypasses the TPRM process to onboard a SaaS tool quickly, citing a 'low-cost' exemption. This scenario BEST illustrates which risk?

Answer: Shadow IT or maverick procurement risk

Shadow IT or maverick procurement occurs when business units engage vendors outside established risk controls, creating unvetted exposure.

When scoring vendor questionnaire responses, an organization uses a weighted scoring model. Which weighting approach is MOST defensible to regulators?

Answer: Assigning higher weights to controls that directly mitigate the highest inherent risks for that vendor's risk tier

Risk-aligned weighting ensures that controls most critical to mitigating a vendor's specific inherent risk profile receive proportionate scoring influence.

A due diligence review reveals that a key IT vendor's most recent penetration test is 28 months old. According to common TPRM best practices, what is the appropriate action?

Answer: Flag as a finding and require an updated penetration test before or shortly after contract renewal

Industry standards and most regulatory guidance expect penetration tests annually or biennially; a 28-month-old test should be flagged and remediation required within a defined timeframe.