CTPRP Third-Party Risk Assessment and Due Diligence 4

Question 1

A financial institution is onboarding a cloud-based payroll processor that will access employee PII. Which due diligence artifact is MOST critical to obtain before contract execution?

Accepted Answer

SOC 2 Type II report covering the prior 12-month period

Answer

A SOC 2 Type II report provides independent, audited evidence of operational effectiveness of security controls over a meaningful period, directly relevant to PII handling.

Question 2

During inherent risk tiering, which combination of factors most commonly elevates a vendor to 'Critical' tier?

Accepted Answer

High data sensitivity, deep system integration, and no viable substitutes

Answer

Critical tier designation typically results from the convergence of sensitive data exposure, deep technical integration, and concentration risk from lack of substitutes.

Question 3

An organization discovers mid-assessment that a Tier 1 vendor subcontracts 60% of its core service delivery to an unnamed fourth party. What is the BEST immediate response?

Accepted Answer

Require disclosure of fourth-party identities and extend due diligence to cover material subcontractors

Answer

Material fourth-party exposure must be identified and assessed; requiring disclosure and extending due diligence preserves visibility into the full risk chain.

Question 4

Which assessment methodology is specifically designed to evaluate a third party's resilience and ability to continue services during a major disruption?

Accepted Answer

Business continuity and disaster recovery (BC/DR) assessment

Answer

BC/DR assessments test whether a vendor has tested recovery plans, defined RTOs/RPOs, and can sustain service delivery through outages or disasters.

Question 5

A procurement team bypasses the TPRM process to onboard a SaaS tool quickly, citing a 'low-cost' exemption. This scenario BEST illustrates which risk?

Accepted Answer

Shadow IT or maverick procurement risk

Answer

Shadow IT or maverick procurement occurs when business units engage vendors outside established risk controls, creating unvetted exposure.

(CTPRP) Certified Third Party Risk Professional Practice Test

(CTPRP) Certified Third Party Risk Professional Practice Test

CTPRP Third-Party Risk Assessment and Due Diligence 4