CTPRP Theory and Fundamentals 2

Question 1

Which principle states that an organization cannot outsource its accountability for regulatory compliance to a third party?

Accepted Answer

Non-delegable duty principle

Answer

The non-delegable duty principle holds that regulated entities remain accountable for compliance obligations even when functions are outsourced to vendors.

Question 2

In third-party risk management, what does 'inherent risk' represent?

Accepted Answer

Risk before any controls or mitigations are considered

Answer

Inherent risk is the level of risk that exists in the absence of any controls, representing the raw exposure from engaging a third party.

Question 3

What is the primary purpose of a risk appetite statement in the context of TPRM?

Accepted Answer

To establish thresholds guiding which third-party risks are acceptable or require mitigation

Answer

A risk appetite statement sets organizational boundaries for tolerable risk levels, guiding decisions on whether to accept, mitigate, transfer, or avoid third-party risks.

Question 4

Which type of third-party relationship typically poses the GREATEST concentration risk?

Accepted Answer

A single vendor supporting multiple critical business functions across the organization

Answer

Concentration risk is highest when a single vendor supports multiple critical functions, meaning vendor failure could simultaneously disrupt numerous key operations.

Question 5

Which framework explicitly introduced the concept of 'nth-party' risk to address extended supply chain exposures?

Accepted Answer

NIST SP 800-161

Answer

NIST SP 800-161 addresses supply chain risk management including nth-party risks arising from subcontractors and vendors of vendors.

(CTPRP) Certified Third Party Risk Professional Practice Test

(CTPRP) Certified Third Party Risk Professional Practice Test

CTPRP Theory and Fundamentals 2