CPE Qualifying Assessment Module (1-7)

1)

Your company has outsourced its call center to a third-party and they are changing telecom providers. What is the relationship your company has with the third party’s telecom provider?

2)

Which of the following services is infrequently outsourced to a third party?

3)

Third party relationships are:

4)

Ransomware is:

5)

12. ISO 27001, a high-level framework, helps companies establish a set of Information Security Management Standards (ISMS) to guide development and implementation of a framework for managing the security of their information assets, including:

6)

Which of the following third party risk management activities is commonly performed by the 1st Line of Defense?

7)

The type and amount of third party risk that remains after taking into consideration the strength of the third party’s control environment is called:

8)

NPPI stands for:

9)

Is “one size fits all” approach to third party risk management effective?

10)

The purpose of third party due diligence is to:

11)

How does mass digitization of records increase operational risk?

12)

What is an important “lesson learned” from serious information security breaches experienced by a large, reputable third parties?

13)

What is the difference between an incident and an issue?

14)

Any serious misalignment between risk control functions, processes and risk taxonomy will:

15)

Which of the following is typically not in scope for third party cyber and information security due diligence?

16)

The most challenging “pane” to address in Johari’s Window is:

17)

Which type of controls could be imposed to offset deficiencies in the third party’s controls and/or immature risk management capabilities in the contracting business unit?

18)

The lifecycle of a third party relationship begins with identifying a business need that will be fulfilled by a third-party and ends with __________.

19)

A performance curve in a third party contract that provides a significant increase in the value of incentive payouts following a relatively small increase in performance level is typically:

20)

Which of the following makes the greatest contribution to effective performance management of critical third parties?

21)

Why are “point of sale” technologies especially vulnerable?

22)

To be useful, risk taxonomy - a common language to identify, classify, understand and communicate risks - must be:

23)

What is the most efficient way to enable comprehensive third party risk reporting?

24)

Accounting for third party vendor services are recorded as _______ on a company’s Income Statement?

25)

To fulfill their responsibilities to customers, shareholders and the board, senior management must have:

26)

Internal risk management controls within market-dominant third parties are always:

27)

What is the most important “lesson learned” from the story about “Larry’s Laptop”?

28)

Which type of risk is your company exposed to in the following case study?

“Your third party’s senior leadership team is experiencing a period of rapid turnover”

29)

When assessing exposure to third party risk, which of the following assessments is subjective?

30)

In the Cloud, identity management, security and compliance:

31)

FCPA is an acronym for:

32)

The type and amount of third party risk that your company assumes by entering in a relationship with a third party before evaluating the strength of the third party’s controls is called:

33)

Governance practices may not be as critically dependent on direct expenditures as they are on the ability of management, boards, audit committees and internal auditors to work together to properly focus oversight attention, and larger banks have an edge in focusing that attention more efficiently.” Collectively, these practices are referred to as:

34)

DDOS (Distributed Denial of Service) attack occurs when:

35)

____________ third parties are out of scope for most third party risk management programs

36)

Transparency and predictability are key indicators of effective:

37)

For greater clarity about the importance and risks of each relationship and easy comparison of risks across your portfolio of critical third party relationships, effective third party risk management programs separate third parties into Tiers, according to:

38)

Unexpected events of such magnitude and consequence that they have a dominant role in history are called:

39)

BIA’s should consider:

40)

What is the most important lesson learned by the Equifax breach?

41)

The best KRIs enable business leaders and risk managers with an opportunity to __________ significant third party risks that are expected to become incidents or losses, before they happen?

42) A company's Risk Appetite is:

43)

Which of the following is an intangible asset?

44)

The weakest link in your company’s defensive perimeter is

45)

A “risk-centric” third party lifecycle management framework:

46)

A copy of the third party’s ISO 22301 Certificate of Compliance that covers contracted services could be an efficient and effective substitute for:

47)

Deficiencies in the third party’s controls identified during due diligence may be mitigated by :

48)

An information or cyber security event is:

49)

Effective risk management, and therefore effective third-party risk management, is strongest in which type of corporate culture?

50)

In relative terms, getting a cold back up site and a hot back up site up and running will take

51)

A third party relationship is:

52)

The difference and relationship between assurance and other monitoring activities is clarified by the:

53)

Internal Audit provides independent assurance to ________________ concerning the effectiveness of third party risk management and controls

54)

To be effective, a core principle of “controllable” metrics in an effective Service Level Agreement is that:

55)

A framework widely used by global companies to help them protect against, prepare for, respond to, and recover from disruptive incidents is:

56)

The most common source of vulnerability to a successful cyber-attack is:

57)

“Tone at the Top” is a term that has been widely adopted to describe

58)

Computer viruses, worms, Trojan horses, ransomware, spyware, adware, and scareware are examples of:

59)

To fulfill their fiduciary duties, boards must:

60)

The core role of Internal Audit in ERM is to:

61)

In a well-designed RACI matrix, if there is more than one designated Responsible party for a specific task there is a need to “zoom in” further detail on the sub process associated with “obtain resource commitment” to:

62)

In the event that one of your company’s third parties suffers a catastrophic failure, which course of action is often the least feasible?

63)

Spyware is not used to:

64) The COSO Internal Control – Integrated Framework is used to:

65)

A third party relationship of such importance that a serious incident or failure would affect most or all of company operations and customers is typically referred to as:

66)

Privacy laws are enacted to:

67)

A client-specific business continuity or disaster recovery plan is:

68)

A structured, consistent and continuous framework across the whole organization for identifying, assessing and deciding on responses to and reporting on opportunities and threats that affect the achievement of its objectives is:

69)

Business line should not approve their ______?

70)

What was the most likely cause for Johnson + Johnson to observe possible damage to their reputation or loss of public trust?

71)

Which Line of Defense is the domain of a company’s risk specialists?

72)

Effective risk management, and therefore effective third-party risk management, is strongest in which type of corporate culture?

73)

Your company and its third parties by formally defining expectations and agreeing on specific requirements is which type of agreement?

74)

In which stage of a third-party’s lifecycle do manufacturers typically excel?

75)

Which one of the following is used to control third party risks?

76)

Which of the following is an indicator of strong incident management practices?

77)

The primary responsibility of Internal Audit in disaster recovery planning is to

78)

Which function owns the third-party relationship and the risks?

79)

The most challenging “pane” to address in Johari’s Window is:

80)

If it was permissible to record a critical third party relationship as an asset, what type of asset would it be?

81)

Due Diligence is which type of third party risk management tool?

82)

Management adopts and implements policies and procedures designed to promote both legal compliance and appropriate standards of honesty, integrity and ethics that are established by:

83)

The most effective cyber and information security due diligence is:

84)

An important contribution to third party risk management made by Internal Audit is to:

85)

The risk thresholds that are aligned with each KRI should be clearly aligned with your company’s:

86)

To assess the potential impact a third party has on your company’s business resilience you should periodically review

87)

What is the primary cause of privacy breaches?

88)

What does a company’s “Risk Tolerance” define?

89)

An important characteristic of any critical third party relationship is:

90)

If a third-party has access to your network or information assets, or if your company accesses a third-party’s services via their web-portal, consider negotiating contractual obligations that:

91)

The simplest way to aggregate third party risks is to:

92)

Tying compensation to the actions of employees and senior management should promote:

93)

The nature and depth of third party due diligence should be proportional with:

94)

At a minimum, well written information and cyber security policies should address:

95)

How is a strong risk culture most effectively expressed within any company?

96)

The inter-related set of ISO standards for cyber and information security are specifically designed to:

97)

The third party risk management framework should align with the corporate:

98)

A key indicator of third party information and cyber security risk is:

99)

Site visits are recommended for

100)

“IoT” The Internet of Things are:

101)

Collectively, the risk management responsibilities of senior management and the board are referred to as?

102)

Another name for a “risk map” is a

103)

What is a significant and recent change in practices related to oversight of third-party risk?

104)

In-depth risk business continuity management risk assessments should be conducted for:

105)

A Risk and Control Self-Assessment (RCSA) is:

106)

All companies need to define the goals and objectives related to Strategic, Financial, Reputational and Operational risk management. What is a common approach for accomplishing this?

107)

The third party relationship is “critical” to the company and/or the business if:

108)

A process/tool that focuses on specific events or processes, compares measures and results using common metrics, and identifies improvement opportunities is:

109)

The most effective way to eliminate third party risks is to:

110)

Trend analysis can identify opportunities:

111)

The findings from a completed Risk Control Self-Assessment (RCSA) can be used:

112)

A standard of comparison of third party risks that is comprised of definitions and rating levels that enable consistent interpretation by different constituencies is:

113)

Cyber risk management is how precious assets such as financial assets, and re-saleable information and intellectual property are protected from:

114)

If the third party is unable to meet your company’s expectations and/or control requirements, possible next steps include:

115)

A risk management strategy where your company contracts with more than one third party to spread the risk may:

116)

A Disaster Recovery Plan is a detailed description of:

117)

Actionable service-level agreements are primarily used to manage the third party’s:

118)

Which Line of Defense owns the third party relationship and its risks?

119)

Open and candid communications throughout the organization, clear lines of authority and responsibility and transparency are key elements of:

120)

A Metric that determines which third party risks will be measured, how they will be measured, and the frequency of measurement is a:

121)

A best practice for business continuity management is:

122)

Which of the following are particularly important for effective risk reporting for senior management?

123)

The majority of companies that paid a ransom as a result of a Malware attack did not report the incident to law enforcement due to:

124)

Which is one of the most important responsibilities that senior management has to create and maintain a strong risk culture?

125)

Which of the following is an example of a separation of duties?

126)

Risk assessment is often performed as a two-stage process. An initial screening of the risks and opportunities is performed using qualitative techniques followed by:

127)

What is one of the most serious outcomes of a serious third party cyber security breach?

128)

After implementing a third party risk management program, cycle time - the time it takes to complete third party due diligence, controls evaluation and contracting – is typically:

129)

Systemic issues are:

130)

An analytical method that consists of an expert opinion of the likelihood of a risk event occurring based on a set of known variables that can be used to determine the probability of each risk event occurring is called:

131)

The Financial Accounting Standards Board (FASB) recognizes the long-term value of intangible assets that have indefinite useful lives. How frequently should their value be tested for impairment?

132)

In a weighted risk rating methodology, an important benefit of isolating criticality of the third party relationship is to:

133)

The best defense against a successful Ransomware attack, one where the company has no feasible alternative to paying the hacker’s ransom, is:

134)

Designating a high proportion of your company’s critical third party relationships as “high risk” results in

135)

In which of the following scenarios is it not advisable to proceed with the third party relationship?

136)

Which function(s) is responsible for establishing Tone at Top?

137)

Specific and measurable Service Level Agreements benefit:

138)

A documented plan that defines the preferred course of action in the event of a serious business interruption or failure, where recovery by the third party is in serious doubt or not expected, is a

139)

Value from any third party relationship is a function of:

140)

What defines a company’s tolerance for accepting third party risks to ensure it is aligned with their Risk Appetite?

141)

The primary role of the board is to:

142)

A third party information security risk event is is more likely to occur and has a higher impact than insurance risk, so would be given ____________ in a risk evaluation model.

143)

Contract provisions should clearly state that the primary third party has accountability for:

144)

A common challenge that companies face when creating methodologies that enable consistent interpretation of third party risk by different constituencies is

145)

The use of a cloud service provider typically means that:

146)

An effective tool for providing assurance of compliance with policies, plans, procedures, laws, regulations and contracts is a:

147)

Which of these is often the weakest link in a company’s defenses?

148)

The nature and amount of residual risk in a third party relationship can only be determined when:

149)

Cyber criminals were most likely to unleash ransomware using:

150)

During third party due diligence, risk control experts should request

151)

Third party risk that your company accepts after analyzing the third party’s controls over those risks is called:

152)

What is the best course of action to determine the effectiveness of third party due diligence, evaluation, controls, processes and tools?

153)

Requiring the third-party to outsource deficient services to another company

154)

What is the main lesson that can be learned from engaging with social media/traditional media?

155)

What is a third-party risk management cost driver?

156)

U.S. Sarbanes-Oxley Act specifically stipulates that senior management has personal liability for:

157)

For core functions, a Disaster Recovery Readiness Assessment Audit should be conducted

158)

Using Johari’s window, in which “pane” would your company’s business requirements reside in a Request for Proposal for a new third party relationship?

159)

During third party due diligence, requesting details of physical security controls, including for visitors and contractors, is:

160)

Which step(s) in the third party lifecycle must be completed before risk experts can confidently define controls that are required for a critical third party?

161)

An example of systemic third party Concentration Risk is:

162)

Risk-Based Authentication:

163)

Which type of third party risk is described in the following case study?

“One of your critical third party’s employees secretly recorded one of their senior executives harassing one of your customers, and the video went viral”

164)

The best type of back-up site for critical services, those that would have a high impact if there is an outage or serious interruption is a:

165)

How are a company’s Risk Appetite and Risk Tolerances tied together?

166)

Which of the following is one of the most important benefits of a third-party risk management program?

167)

A framework that helps define the role of the board and management, delineates duties and helps prevent duplicated efforts and the overlooking of critical issues is called a ____________ framework:

168)

A disadvantage of qualitative assessments of third party risks is that it:

169)

Inherent risk is ________________ the critical services delivered by the third party.

170)

To increase monitoring effectiveness, management should periodically rank third party relationships according to risk to determine:

171)

The BIA should identify:

172)

When Internal Audit’s role extends beyond its core role/purpose, it should be:

173)

Which type of risk is your company exposed to in the following case study?

“Your third party is left without electrical power as a result of a serious fire”

174)

An important responsibility of third party risk oversight committees is a willingness to:

175)

A process that is useful for assessing third party risks and tying them back to strategic objectives is: