CTPRP Ongoing Monitoring and Continuous Oversight

Question 1

Which factor should MOST influence the frequency of ongoing monitoring reviews for a third-party vendor?

Accepted Answer

The vendor's inherent risk tier assigned during initial onboarding

Answer

Ongoing monitoring frequency is driven primarily by the inherent risk tier. High-risk vendors (those with access to sensitive data, critical systems, or regulated functions) require more frequent reassessments than low-risk vendors. Contract renewal dates, headcount, and geography are secondary or irrelevant without a risk-tier context.

Question 2

A vendor that previously scored 'low risk' in its initial due diligence assessment has just disclosed a major data breach affecting another client. What is the MOST appropriate immediate action?

Accepted Answer

Trigger an out-of-cycle risk reassessment and request an incident report from the vendor

Answer

A material adverse event — such as a data breach — is a recognized trigger for an out-of-cycle reassessment. The organization must quickly understand whether the breach affects its own data or services before deciding on next steps. Waiting for an annual review ignores an emerging risk; immediate termination without investigation is premature.

Question 3

Key Risk Indicators (KRIs) used in continuous vendor monitoring are BEST described as:

Accepted Answer

Forward-looking metrics that signal rising risk before an adverse event occurs

Answer

KRIs are predictive, forward-looking indicators designed to warn that risk is increasing before an adverse event materializes. They differ from Key Performance Indicators (KPIs), which measure outcomes, and from audit findings or SLA penalties, which are reactive.

Question 4

Which of the following is a recognized TRIGGER for an unscheduled reassessment of a third-party vendor?

Accepted Answer

The vendor is acquired by or merges with another company

Answer

A merger or acquisition of the vendor is a classic trigger for an out-of-cycle reassessment because it can fundamentally change the vendor's ownership, controls, financial stability, and subcontractor relationships. Completing a routine audit, internal sponsor changes, or entering a final contract year do not by themselves constitute material risk events.

Question 5

What is the PRIMARY purpose of maintaining a vendor inventory as part of an ongoing monitoring program?

Accepted Answer

To enable risk-tiered oversight and ensure no vendor relationship goes unmonitored

Answer

A complete, accurate vendor inventory is foundational to third-party risk management because you cannot monitor what you cannot see. It allows the organization to apply risk-tiered controls to every vendor, preventing gaps in oversight. While an inventory may satisfy audit requirements as a byproduct, risk visibility is the primary driver.

(CTPRP) Certified Third Party Risk Professional Practice Test

(CTPRP) Certified Third Party Risk Professional Practice Test

CTPRP Ongoing Monitoring and Continuous Oversight