CTPRP Third-Party Risk Assessment and Due Diligence

Question 1

Which document is most commonly used as the foundation for third-party risk assessments in the US financial sector?

Accepted Answer

Standardized Information Gathering (SIG) questionnaire

Answer

The SIG questionnaire, developed by Shared Assessments, is the industry standard tool for gathering third-party risk information in the financial and other regulated sectors.

Question 2

What is the primary purpose of inherent risk scoring during vendor due diligence?

Accepted Answer

To prioritize vendors by potential risk before controls are considered

Answer

Inherent risk scoring evaluates the risk a third party poses based on the nature of the engagement, independent of any controls the vendor may have in place.

Question 3

During onboarding due diligence, which factor most increases a vendor's risk tier?

Accepted Answer

Access to sensitive customer data or critical systems

Answer

Access to sensitive data or critical systems is the primary driver for escalating a vendor to a higher risk tier requiring more rigorous due diligence.

Question 4

What is a 'fourth-party risk' in the context of third-party risk management?

Accepted Answer

Risk posed by your vendor's subcontractors or suppliers

Answer

Fourth-party risk refers to the risk exposure that arises from the subcontractors and service providers used by your direct (third-party) vendors.

Question 5

Which assessment type involves an on-site visit to the vendor's facilities to verify controls firsthand?

Accepted Answer

On-site assessment

Answer

An on-site assessment allows the assessing organization to directly observe and verify the vendor's operational controls and physical security measures.

(CTPRP) Certified Third Party Risk Professional Practice Test

(CTPRP) Certified Third Party Risk Professional Practice Test

CTPRP Third-Party Risk Assessment and Due Diligence