CTPRP Repertoire and Literature 5

Question 1

In TPRM literature, the 'right to audit' clause in a vendor contract primarily serves to:

Accepted Answer

Allow the organization to assess the vendor's compliance and controls firsthand

Answer

Enable the vendor to charge additional fees for compliance reviews

Answer

Restrict the vendor from using subcontractors without approval

Answer

Limit liability for both parties in the event of a data breach

Question 2

The Financial Stability Board (FSB) publication 'Regulatory and Supervisory Issues Relating to Outsourcing and Third-Party Relationships' (2023) emphasizes which emerging risk topic?

Accepted Answer

Concentration risk from reliance on a small number of critical third-party providers

Answer

Mandatory real-time data sharing between financial institutions

Answer

Elimination of offshore outsourcing for regulated firms

Answer

Standardized global pricing for cloud services

Question 3

A Vendor Risk Management (VRM) policy document should include all of the following EXCEPT:

Accepted Answer

Pre-approved vendor pricing schedules

Answer

Risk tiering criteria for classifying vendors

Answer

Roles and responsibilities of stakeholders

Answer

Escalation procedures for critical vendor issues

Question 4

The principle of 'defense in depth' as applied to third-party risk means:

Accepted Answer

Layering multiple controls and assessment methods to reduce vendor risk

Answer

Requiring vendors to maintain separate backup data centers

Answer

Limiting vendor access to only one system at a time

Answer

Using a single comprehensive assessment tool instead of multiple questionnaires

Question 5

Which NIST publication specifically provides guidance on risk assessment processes, including those applicable to third-party risk evaluations?

Accepted Answer

NIST SP 800-30

Answer

NIST SP 800-53

Answer

NIST SP 800-171

Answer

NIST SP 800-37

Question 6

In TPRM literature, 'residual risk' is defined as:

Accepted Answer

The risk remaining after controls and mitigations have been applied

Answer

The initial risk estimate before any vendor assessment is performed

Answer

The contractual liability retained by the vendor after a breach

Answer

The portion of vendor risk transferred through insurance

Question 7

The Shared Assessments Standardized Control Assessment (SCA) procedure is designed to be used in conjunction with the SIG to:

Accepted Answer

Provide on-site testing procedures that validate vendor responses to the SIG questionnaire

Answer

Automate vendor scoring using AI-based analysis of questionnaire data

Answer

Replace contractual audit rights for lower-tier vendors

Answer

Generate mandatory regulatory reports for banking supervisors