CTPRP Professional Practice 3

Question 1

Which governance structure component ensures that third-party risk management aligns with the organization's overall enterprise risk appetite?

Accepted Answer

Risk appetite statement

Answer

The risk appetite statement sets the boundaries within which TPRM decisions must operate, ensuring alignment with organizational strategy.

Question 2

An organization is offboarding a vendor that had access to sensitive customer data. Which action is MOST critical during offboarding?

Accepted Answer

Confirming data destruction or return and revoking all access credentials

Answer

Data disposition and access revocation are the highest-priority security tasks during vendor offboarding to prevent unauthorized data retention or access.

Question 3

What distinguishes a 'critical' vendor from an 'important' vendor in most TPRM frameworks?

Accepted Answer

Critical vendors perform functions whose failure would significantly disrupt operations or harm customers

Answer

Criticality is defined by the impact of failure, not by contract size or geography, and triggers stricter oversight requirements.

Question 4

Which regulatory body issued the 2023 guidance 'Third-Party Relationships: Risk Management' applicable to US national banks and federal savings associations?

Accepted Answer

OCC

Answer

The OCC's 2023 interagency guidance on third-party relationships provides the risk management framework for national banks and federal savings associations.

Question 5

When evaluating a vendor's financial health during due diligence, which indicator raises the MOST immediate concern?

Accepted Answer

Going concern opinion from the external auditor

Answer

A going concern opinion indicates the auditor doubts the vendor's ability to continue operations, representing a critical continuity risk.

(CTPRP) Certified Third Party Risk Professional Practice Test

(CTPRP) Certified Third Party Risk Professional Practice Test

CTPRP Professional Practice 3