CTPRP Professional Practice 2

Question 1

Which document formally defines the responsibilities, expectations, and performance metrics agreed upon between an organization and its third party?

Accepted Answer

Service Level Agreement (SLA)

Answer

An SLA specifically captures measurable performance targets and accountability provisions between the organization and the third party.

Question 2

A CTPRP practitioner discovers a vendor has subcontracted critical processing to a fourth party without prior disclosure. What is the MOST appropriate immediate action?

Accepted Answer

Notify the vendor and escalate per the incident response plan

Answer

Undisclosed subcontracting is a contract breach and potential risk event requiring escalation through the established incident response process.

Question 3

What is the primary purpose of a vendor tiering model in third-party risk management?

Accepted Answer

To prioritize due diligence and monitoring intensity based on risk exposure

Answer

Tiering allows organizations to allocate limited resources by applying the most rigorous controls to vendors that pose the greatest risk.

Question 4

Which phase of the third-party risk lifecycle involves assessing whether a prospective vendor's risk profile is acceptable before contracting?

Accepted Answer

Pre-contract due diligence

Answer

Pre-contract due diligence evaluates inherent and residual risk before the organization commits to a vendor relationship.

Question 5

Under US regulatory guidance, which type of vendor relationship typically triggers the HIGHEST level of regulatory scrutiny?

Accepted Answer

Critical service providers that perform functions material to the institution

Answer

Regulators such as OCC and FFIEC require heightened oversight for vendors performing functions that could significantly impact operations, customers, or compliance.

(CTPRP) Certified Third Party Risk Professional Practice Test

(CTPRP) Certified Third Party Risk Professional Practice Test

CTPRP Professional Practice 2