CTPRP Communication and Expression 3

Question 1

What communication technique is most effective when presenting conflicting risk opinions from multiple assessors to a risk committee?

Accepted Answer

Summarize each perspective with supporting evidence and recommend a consensus position

Answer

Present only the most optimistic assessment to avoid alarm

Answer

Assign blame to the assessor whose view differs from the majority

Answer

Exclude minority opinions from the committee presentation

Question 2

How should TPRM practitioners communicate inherent risk versus residual risk to non-technical business owners?

Accepted Answer

Explain inherent risk as the starting exposure and residual risk as what remains after controls are applied

Answer

Use identical risk scores for both to simplify understanding

Answer

Avoid discussing inherent risk since controls already address it

Answer

Present only residual risk to avoid overwhelming stakeholders

Question 3

Which approach best supports effective communication in a multi-stakeholder TPRM governance structure?

Accepted Answer

Tailored communications that address each stakeholder group's specific responsibilities and risk appetite

Answer

One universal risk report sent to all stakeholders regardless of role

Answer

Verbal-only updates to reduce documentation burden

Answer

Restricting TPRM communications to the CISO and CRO only

Question 4

When communicating a vendor's improved risk posture after remediation, what should the TPRM report include?

Accepted Answer

Before-and-after risk scores, remediated findings, and any residual or accepted risks

Answer

Only the current risk rating without historical context

Answer

Vendor marketing materials about their security improvements

Answer

A statement that all risks have been fully resolved

Question 5

A TPRM practitioner must communicate the same risk finding to both the IT team and the legal department. What should differ between these communications?

Accepted Answer

The framing, emphasis, and terminology used to reflect each audience's concerns

Answer

The factual accuracy of the finding

Answer

The severity rating assigned to the finding

Answer

The timeline for required remediation

Question 6

What is the most appropriate channel for communicating a time-sensitive vendor concentration risk identified during a portfolio review?

Accepted Answer

Immediately brief key decision-makers verbally and follow up with written documentation

Answer

Include it in the next quarterly board deck without prior notification

Answer

Post the finding on the intranet for all employees to review

Answer

Wait for the vendor's annual review meeting to raise the issue

Question 7

Which element transforms a TPRM status update into a decision-enabling communication?

Accepted Answer

Including clear recommendations with defined options and trade-offs for leadership action

Answer

Maximizing the length and detail of the report

Answer

Listing all vendor names and contract values

Answer

Using technical assessment methodology descriptions