CTPRP Third-Party Risk Assessment and Due Diligence 5

Question 1

An organization is assessing a legal services vendor that handles confidential litigation documents. Which due diligence domain is MOST uniquely important for this vendor type compared to a standard IT vendor?

Accepted Answer

Attorney-client privilege, confidentiality obligations, and bar compliance

Answer

Legal vendors introduce privilege and professional ethics dimensions — confidentiality obligations under bar rules and privilege waiver risk — that are not standard IT control concerns.

Question 2

Which metric is MOST useful for evaluating the effectiveness of an organization's third-party due diligence program over time?

Accepted Answer

Percentage of Tier 1 vendors with completed, current assessments within the defined reassessment cycle

Answer

Assessment coverage rate for critical vendors directly measures whether the program is maintaining current risk visibility where it matters most.

Question 3

A vendor's SOC 2 Type II report contains several 'exceptions noted' within the change management control area. What is the MOST appropriate risk management response?

Accepted Answer

Request a management letter and compensating controls documentation, then assess residual risk before proceeding

Answer

Exceptions require further investigation through management responses and compensating controls; a risk-based decision can then be made rather than automatic rejection.

Question 4

Under the OCC's Third-Party Risk Management guidance, which phase of the vendor lifecycle is explicitly called out as requiring board or senior management oversight for critical activities?

Accepted Answer

Planning, due diligence, contract negotiation, ongoing monitoring, and termination — all phases for critical activities

Answer

The OCC guidance states that board and senior management oversight should span all phases of the third-party relationship lifecycle for critical activities, not just a single phase.

Question 5

An assessor is evaluating a vendor's information security program and finds the vendor holds ISO 27001 certification. What is the LIMITATION of relying solely on this certification for due diligence?

Accepted Answer

Certification confirms a management system is in place but does not guarantee absence of specific control gaps or current threat effectiveness

Answer

ISO 27001 certifies that an ISMS framework exists and meets the standard's requirements at a point in time, but does not provide detailed control-level testing results or guarantee real-world effectiveness.

(CTPRP) Certified Third Party Risk Professional Practice Test

(CTPRP) Certified Third Party Risk Professional Practice Test

CTPRP Third-Party Risk Assessment and Due Diligence 5