CTPRP Repertoire and Literature 5

Question 1

In TPRM literature, the 'right to audit' clause in a vendor contract primarily serves to:

Accepted Answer

Allow the organization to assess the vendor's compliance and controls firsthand

Answer

A right-to-audit clause contractually entitles the contracting organization to assess the vendor's controls, processes, and compliance with agreed standards.

Question 2

The Financial Stability Board (FSB) publication 'Regulatory and Supervisory Issues Relating to Outsourcing and Third-Party Relationships' (2023) emphasizes which emerging risk topic?

Accepted Answer

Concentration risk from reliance on a small number of critical third-party providers

Answer

The 2023 FSB paper highlights systemic concentration risk as a key concern when many regulated firms rely on the same small set of critical service providers such as cloud hyperscalers.

Question 3

A Vendor Risk Management (VRM) policy document should include all of the following EXCEPT:

Accepted Answer

Pre-approved vendor pricing schedules

Answer

VRM policies cover governance, risk tiering, roles, and escalation procedures; pricing schedules are a procurement or commercial matter, not a risk policy element.

Question 4

The principle of 'defense in depth' as applied to third-party risk means:

Accepted Answer

Layering multiple controls and assessment methods to reduce vendor risk

Answer

Defense in depth in TPRM involves using multiple overlapping controls — questionnaires, on-site audits, continuous monitoring — so no single control failure exposes the organization.

Question 5

Which NIST publication specifically provides guidance on risk assessment processes, including those applicable to third-party risk evaluations?

Accepted Answer

NIST SP 800-30

Answer

NIST SP 800-30 ('Guide for Conducting Risk Assessments') provides a structured process for identifying, analyzing, and communicating risk, applicable to vendor risk assessments.

(CTPRP) Certified Third Party Risk Professional Practice Test

(CTPRP) Certified Third Party Risk Professional Practice Test

CTPRP Repertoire and Literature 5