CTPRP Risk Reporting, Governance, and Program Management

Question 1

Which body within an organization typically has ULTIMATE accountability for the third-party risk management program?

Accepted Answer

The Board of Directors or a delegated committee such as the Risk Committee

Answer

Governance accountability for enterprise risk programs — including TPRM — rests at the Board or its delegated committee (e.g., Audit and Risk Committee). The Board sets risk appetite and expects management to report on TPRM program effectiveness. Procurement, IT, and business lines have operational roles, but ultimate accountability is at the governance level.

Question 2

A 'risk appetite statement' in the context of third-party risk management defines:

Accepted Answer

The level and types of vendor-related risk the organization is willing to accept in pursuit of its objectives

Answer

A risk appetite statement articulates how much and what kinds of third-party risk the organization is prepared to tolerate. It guides decisions such as which vendor tiers receive enhanced due diligence, when to reject a vendor despite business pressure, and how aggressively to pursue remediation. It is a governance document, not a procurement threshold or SLA benchmark.

Question 3

Which metric would be MOST useful to include in a quarterly TPRM dashboard presented to senior management?

Accepted Answer

The number of high-risk vendors with overdue remediation items

Answer

Senior leadership needs actionable risk intelligence. The number of high-risk vendors with overdue remediation items is a direct indicator of unresolved risk exposure that may require executive escalation or resource allocation. Analyst tenure, invoice volumes, and vendor employee satisfaction do not convey meaningful risk posture to a risk dashboard audience.

Question 4

The 'offboarding' phase of the vendor lifecycle is important to third-party risk management primarily because:

Accepted Answer

It ensures the organization's data is returned or destroyed and access is revoked when a vendor relationship ends

Answer

Offboarding is a critical risk control point. When a vendor relationship ends, the organization must ensure all data (including sensitive customer or proprietary data) is securely returned or destroyed per contractual and regulatory requirements, and that all system access credentials are revoked. Failure to manage offboarding can leave data exposed or former vendors with ongoing access.

Question 5

An organization uses a tiered vendor classification system (e.g., Tier 1 = Critical, Tier 2 = High, Tier 3 = Low). What is the PRIMARY benefit of this approach?

Accepted Answer

It allows TPRM resources and controls to be proportionally allocated based on the risk each vendor presents

Answer

Tiering allows risk-proportionate resource allocation — applying more rigorous (and expensive) due diligence, more frequent monitoring, and stronger contractual protections to vendors that present greater risk. Applying the same level of scrutiny to every vendor would be impractical and inefficient. Tiering is a foundational TPRM program design decision, not primarily a procurement or compliance mechanism.

(CTPRP) Certified Third Party Risk Professional Practice Test

(CTPRP) Certified Third Party Risk Professional Practice Test

CTPRP Risk Reporting, Governance, and Program Management