CTPRP Communication and Expression 3 — Questions and Answers
Question 1: What communication technique is most effective when presenting conflicting risk opinions from multiple assessors to a risk committee?
- Present only the most optimistic assessment to avoid alarm
- Summarize each perspective with supporting evidence and recommend a consensus position (Correct answer)
- Assign blame to the assessor whose view differs from the majority
- Exclude minority opinions from the committee presentation
Correct answer: Summarize each perspective with supporting evidence and recommend a consensus position
Presenting all perspectives with supporting evidence and a recommended position enables the committee to make well-informed decisions.
Question 2: How should TPRM practitioners communicate inherent risk versus residual risk to non-technical business owners?
- Use identical risk scores for both to simplify understanding
- Explain inherent risk as the starting exposure and residual risk as what remains after controls are applied (Correct answer)
- Avoid discussing inherent risk since controls already address it
- Present only residual risk to avoid overwhelming stakeholders
Correct answer: Explain inherent risk as the starting exposure and residual risk as what remains after controls are applied
Distinguishing inherent from residual risk helps business owners understand the value of controls and remaining exposure.
Question 3: Which approach best supports effective communication in a multi-stakeholder TPRM governance structure?
- One universal risk report sent to all stakeholders regardless of role
- Tailored communications that address each stakeholder group's specific responsibilities and risk appetite (Correct answer)
- Verbal-only updates to reduce documentation burden
- Restricting TPRM communications to the CISO and CRO only
Correct answer: Tailored communications that address each stakeholder group's specific responsibilities and risk appetite
Tailored communications ensure each stakeholder group receives actionable, role-relevant information aligned to their responsibilities.
Question 4: When communicating a vendor's improved risk posture after remediation, what should the TPRM report include?
- Only the current risk rating without historical context
- Before-and-after risk scores, remediated findings, and any residual or accepted risks (Correct answer)
- Vendor marketing materials about their security improvements
- A statement that all risks have been fully resolved
Correct answer: Before-and-after risk scores, remediated findings, and any residual or accepted risks
Comparative before-and-after reporting with residual risk documentation provides a complete and accurate picture of the vendor's risk trajectory.
Question 5: A TPRM practitioner must communicate the same risk finding to both the IT team and the legal department. What should differ between these communications?
- The factual accuracy of the finding
- The framing, emphasis, and terminology used to reflect each audience's concerns (Correct answer)
- The severity rating assigned to the finding
- The timeline for required remediation
Correct answer: The framing, emphasis, and terminology used to reflect each audience's concerns
Effective communication tailors language and emphasis to the audience's domain expertise and concerns while keeping the factual risk content consistent.
Question 6: What is the most appropriate channel for communicating a time-sensitive vendor concentration risk identified during a portfolio review?
- Include it in the next quarterly board deck without prior notification
- Immediately brief key decision-makers verbally and follow up with written documentation (Correct answer)
- Post the finding on the intranet for all employees to review
- Wait for the vendor's annual review meeting to raise the issue
Correct answer: Immediately brief key decision-makers verbally and follow up with written documentation
Time-sensitive concentration risks require immediate verbal escalation to decision-makers followed by formal written documentation.
Question 7: Which element transforms a TPRM status update into a decision-enabling communication?
- Maximizing the length and detail of the report
- Including clear recommendations with defined options and trade-offs for leadership action (Correct answer)
- Listing all vendor names and contract values
- Using technical assessment methodology descriptions
Correct answer: Including clear recommendations with defined options and trade-offs for leadership action
Decision-enabling communications provide specific recommendations with options and trade-offs so leadership can take informed action.
CTPRP Communication and Expression 3
What communication technique is most effective when presenting conflicting risk opinions from multiple assessors to a risk committee?