CTPRP Performance Techniques 2 — Questions and Answers
Question 1: Which metric best measures a third party's ability to meet agreed service levels over time?
- Service Level Agreement (SLA) compliance rate (Correct answer)
- Number of employees at the vendor
- Vendor's annual revenue growth
- Total contract value
Correct answer: Service Level Agreement (SLA) compliance rate
SLA compliance rate directly quantifies whether the vendor is delivering on contractually agreed performance targets.
Question 2: A risk manager notices a vendor's KRI threshold was breached last quarter but no escalation occurred. What process likely failed?
- Vendor onboarding
- KRI monitoring and escalation protocol (Correct answer)
- Contract negotiation
- Due diligence questionnaire
Correct answer: KRI monitoring and escalation protocol
A breach without escalation indicates the KRI monitoring and escalation protocol was not followed or enforced.
Question 3: What is the primary purpose of a vendor scorecard in third-party risk management?
- To document all vendor invoices
- To provide a consolidated view of vendor performance against defined criteria (Correct answer)
- To track vendor employee headcount
- To record vendor insurance certificates
Correct answer: To provide a consolidated view of vendor performance against defined criteria
A vendor scorecard aggregates performance data across multiple dimensions to give a holistic view of vendor health.
Question 4: During a periodic vendor review, a supplier consistently meets SLAs but shows increasing staff turnover. Which risk does this signal?
- Reputational risk
- Concentration risk
- Key person and operational continuity risk (Correct answer)
- Regulatory compliance risk
Correct answer: Key person and operational continuity risk
High staff turnover at a critical vendor threatens continuity of service due to loss of institutional knowledge and key personnel.
Question 5: Which of the following is a leading indicator of vendor performance deterioration?
- A vendor successfully renewing its ISO 27001 certification
- Increasing ticket resolution times trending above baseline over 90 days (Correct answer)
- A vendor completing required annual training on time
- Vendor submitting invoices accurately
Correct answer: Increasing ticket resolution times trending above baseline over 90 days
A trend of increasing resolution times signals degrading operational capacity before a formal SLA breach occurs.
Question 6: What is the recommended approach when a vendor disputes a performance penalty assessed in a quarterly review?
- Immediately terminate the contract
- Waive the penalty to preserve the relationship
- Follow the dispute resolution process defined in the contract (Correct answer)
- Escalate directly to the vendor's CEO
Correct answer: Follow the dispute resolution process defined in the contract
Contracts typically include dispute resolution clauses that provide a structured, documented path for resolving disagreements.
Question 7: A company uses a tiered vendor classification system. Which tier typically requires the most frequent performance reviews?
- Tier 3 — low-risk, non-critical vendors
- Tier 2 — moderate-risk vendors
- Tier 1 — critical, high-risk vendors (Correct answer)
- All tiers require the same review frequency
Correct answer: Tier 1 — critical, high-risk vendors
Tier 1 critical vendors receive the most scrutiny because their failure could have material operational or regulatory impact.
CTPRP Performance Techniques 2
Which metric best measures a third party's ability to meet agreed service levels over time?