CTPRP History and Cultural Context 2

Question 1

Which regulatory event in the early 2000s most directly accelerated the formalization of third-party risk management as a distinct discipline?

Accepted Answer

The Sarbanes-Oxley Act of 2002

Answer

SOX 2002 forced organizations to formally assess and document controls across their entire value chain, including third parties, elevating TPRM from informal practice to structured discipline.

Question 2

The concept of 'fourth-party risk' emerged primarily in response to which industry trend?

Accepted Answer

Third parties outsourcing critical functions to their own subcontractors

Answer

Fourth-party risk arose as organizations recognized that their vendors' own subcontractors (subvendors) could introduce risks that flowed upstream to the original contracting organization.

Question 3

In TPRM history, what cultural shift occurred when organizations began treating vendor risk as a continuous lifecycle rather than a point-in-time assessment?

Accepted Answer

The shift from annual audits to real-time monitoring

Answer

The evolution from periodic snapshot assessments to continuous monitoring represented a foundational cultural shift, driven by high-profile breaches showing that risk profiles change rapidly between assessment cycles.

Question 4

Which cultural factor most commonly leads organizations to underestimate risks from long-standing vendor relationships?

Accepted Answer

Overconfidence due to familiarity and historical trust

Answer

Familiarity bias causes risk teams to grant legacy vendors implicit trust and lighter scrutiny, even as those vendors' risk profiles, ownership, or security postures evolve over time.

Question 5

The 2013 Target data breach became a landmark case in TPRM history primarily because it demonstrated what previously underappreciated risk vector?

Accepted Answer

Compromise via a trusted HVAC and facilities vendor's network access

Answer

The Target breach showed that attackers could pivot into a major retailer's network through a seemingly low-risk third-party vendor (Fazio Mechanical), transforming how the industry viewed vendor access management.

(CTPRP) Certified Third Party Risk Professional Practice Test

(CTPRP) Certified Third Party Risk Professional Practice Test

CTPRP History and Cultural Context 2