CTPRP Repertoire and Literature 3

Question 1

SOC 2 reports, commonly reviewed during third-party due diligence, are based on which set of criteria?

Accepted Answer

AICPA Trust Services Criteria

Answer

SOC 2 reports are based on the AICPA Trust Services Criteria, which evaluate controls related to security, availability, processing integrity, confidentiality, and privacy.

Question 2

Which publication from the Federal Reserve, OCC, and FDIC provides interagency guidance on third-party relationships for banking organizations?

Accepted Answer

Interagency Guidance on Third-Party Relationships: Risk Management (2023)

Answer

In 2023, the Federal Reserve, OCC, and FDIC jointly issued interagency guidance providing a consistent framework for banks managing third-party relationship risks.

Question 3

In the context of TPRM literature, 'fourth-party risk' refers to:

Accepted Answer

Risks arising from a vendor's own vendors and subcontractors

Answer

Fourth-party risk refers to the risk an organization faces from its vendors' subcontractors (third parties to the third party), which may not be directly visible.

Question 4

The Gramm-Leach-Bliley Act (GLBA) Safeguards Rule requires financial institutions to:

Accepted Answer

Oversee service provider arrangements that involve customer financial data

Answer

The GLBA Safeguards Rule requires financial institutions to oversee their service providers to ensure appropriate safeguards are in place for customer financial information.

Question 5

ISO 31000:2018, the international risk management standard, defines risk as:

Accepted Answer

The effect of uncertainty on objectives

Answer

ISO 31000:2018 defines risk as 'the effect of uncertainty on objectives,' a broader definition than probability-times-impact formulations.

(CTPRP) Certified Third Party Risk Professional Practice Test

(CTPRP) Certified Third Party Risk Professional Practice Test

CTPRP Repertoire and Literature 3