CTPRP Regulatory Compliance and Vendor Governance 2

Question 1

Which element of a vendor contract directly defines the performance standards the vendor must meet?

Accepted Answer

Service-Level Agreement (SLA)

Answer

An SLA specifies measurable performance metrics such as uptime, response time, and resolution times that the vendor is contractually obligated to maintain.

Question 2

What is the significance of PCI DSS compliance for a vendor handling payment card data?

Accepted Answer

It confirms the vendor meets security standards required to store, process, or transmit cardholder data

Answer

PCI DSS compliance demonstrates that the vendor has implemented the required controls to protect cardholder data, reducing the payment-related risk to organizations that share card data with them.

Question 3

In vendor governance, what does 'escalation path' refer to?

Accepted Answer

The defined process for raising unresolved vendor issues to higher authority

Answer

An escalation path defines the steps and authorities involved when vendor performance issues, control failures, or contractual disputes cannot be resolved at the operational level.

Question 4

Which committee or group within an organization typically has oversight responsibility for the enterprise third-party risk management program?

Accepted Answer

Risk Committee or Third-Party Risk Oversight Committee

Answer

A dedicated Risk Committee or Third-Party Risk Oversight Committee provides executive-level governance, ensuring TPRM is aligned with enterprise risk appetite and regulatory expectations.

Question 5

When a vendor is classified as 'critical,' what additional oversight is typically required beyond standard due diligence?

Accepted Answer

Enhanced monitoring, executive engagement, and contingency planning

Answer

Critical vendors receive heightened oversight including more frequent assessments, senior-level relationship management, and tested contingency or exit plans due to their impact on business operations.

(CTPRP) Certified Third Party Risk Professional Practice Test

(CTPRP) Certified Third Party Risk Professional Practice Test

CTPRP Regulatory Compliance and Vendor Governance 2