Free CIS-TPRM sample questions

Correct answer: It provides a centralized platform to manage the third-party risk lifecycle without relying on disparate emails and spreadsheets.

The primary purpose of the TPRM application is to centralize, standardize, and automate the third-party risk lifecycle. It eliminates the need for manual tracking via emails and spreadsheets, providing a single source of truth for vendor risk data, assessments, and issues.

Correct answer: Onboarding -> Tiering -> Assessment -> Issue Management -> Continuous Monitoring

The standard TPRM process begins with Onboarding the third party. Next, Tiering (via IRQ) determines the risk level. Based on the tier, an Assessment is conducted. Any findings result in Issue Management. Finally, the relationship enters Continuous Monitoring to track ongoing risk.

Correct answers: Third party [core_third_party]; Third-party Risk Assessment [sn_vdr_risk_asmt_assessment]

The core_third_party table is the foundational table for storing third-party organizational records in the TPRM application.

The sn_vdr_risk_asmt_assessment table stores the actual risk assessment records sent to third parties, making it critical for TPRM reporting.

Correct answer: Risk Statement

In the ServiceNow GRC architecture, registered risks are captured as Risk Statements. These statements can be applied to various entities, including third parties, to track and evaluate specific risk exposures consistently across the enterprise.

Correct answer: The Third-party Portal

The Third-party Portal is the dedicated interface within the TPRM application for external vendors. It allows them to securely respond to assessments, manage issues, and update their contacts. It is distinct from the Customer Service Portal, which is used for external customer support queries.

Correct answer: Tiering

The Inherent Risk Questionnaire (IRQ) is utilized during the Tiering phase. It is typically sent to an internal business owner to assess the inherent risk of engaging with the third party. The responses dictate the third party's Rank Tier, which subsequently drives the type and rigor of the due diligence and risk assessment required in the next phase.