CTPRP Third-Party Risk Assessment and Due Diligence

Question 1

Which document is most commonly used as the foundation for third-party risk assessments in the US financial sector?

Accepted Answer

Standardized Information Gathering (SIG) questionnaire

Answer

ISO 9001 checklist

Answer

GDPR Article 28 template

Answer

NIST SP 800-37 form

Question 2

What is the primary purpose of inherent risk scoring during vendor due diligence?

Accepted Answer

To prioritize vendors by potential risk before controls are considered

Answer

To calculate the vendor's annual contract value

Answer

To determine the vendor's credit rating

Answer

To assess the vendor's marketing capabilities

Question 3

During onboarding due diligence, which factor most increases a vendor's risk tier?

Accepted Answer

Access to sensitive customer data or critical systems

Answer

Vendor's geographic location within the US

Answer

Number of employees at the vendor company

Answer

Vendor's length of time in business

Question 4

What is a 'fourth-party risk' in the context of third-party risk management?

Accepted Answer

Risk posed by your vendor's subcontractors or suppliers

Answer

Risk from regulatory bodies auditing your organization

Answer

Risk from competitors accessing your vendor data

Answer

Risk from internal employees misusing vendor systems

Question 5

Which assessment type involves an on-site visit to the vendor's facilities to verify controls firsthand?

Accepted Answer

On-site assessment

Answer

Desk-based assessment

Answer

Automated scan

Answer

Passive monitoring

Question 6

In the CTPRP framework, what does 'residual risk' mean after vendor controls are evaluated?

Accepted Answer

The remaining risk after accounting for the vendor's controls and mitigations

Answer

The total risk before any controls are applied

Answer

The risk transferred to cyber insurance

Answer

The vendor's compliance score on a SIG questionnaire