A. An assessment of a third party should include its compliance and risk infrastructure, financials, business strategy and operating history.
B. An assessment of a third party should not include its compliance and risk infrastructure, financials, business strategy and operating history.
C. Onsite visits are not advantageous for understanding the third party's risks and control environment.
D. A review of the pay levels of the staff supporting the service.
Explanation:
Third-Party Risk Management (TPRM)
PRMIA highlights the importance of conducting thorough due diligence on third-party vendors and service providers.
This includes evaluating compliance programs, risk management frameworks, financial stability,
strategic objectives, and operational history.
Key Areas of Third-Party Risk Assessment
Compliance and Risk Infrastructure → Ensures that the provider meets regulatory and security requirements.
Financial Health → Determines whether the provider has the financial stability to support long-term service delivery.
Business Strategy → Helps assess alignment with the organization’s risk appetite and goals.
Operating History → Evaluates experience and reliability in delivering services.
Explanation
Incorrect C Ignoring these critical factors increases the risk of working with an unreliable vendor.
Incorrect C Onsite visits are highly valuable as they provide first-hand insights into operational controls. PRMIA encourages risk managers to conduct site visits.
D. A review of the pay levels of the staff supporting Incorrect C Employee salaries are not a primary risk
the service. factor in vendor assessments. The focus should be on the vendor’s security, compliance, and
operational risks.
PRMIA Reference for Verification
PRMIA Third-Party Risk Management (TPRM) Guidelines C Details best practices for vendor risk assessments.
Basel Principles on Outsourcing and Third-Party Risk C Provides regulatory guidance on evaluating third-party service providers.
