01. A risk intelligence provider is registered with Order reports selected and has request types for its Level 1 and Level 2 reports. The organization’s agreement with that provider covers only Level 1 reports. A TPR manager submits a Level 2 request for a third party.
How does TPRM handle this request?
a) It submits the order and records the outcome, and the provider decides whether it can be fulfilled
b) It blocks submission when the request type is not covered by the agreement recorded on the provider record
c) It holds the request in Open until a TPR assessment reviewer confirms that the provider’s prerequisites are met
d) It sends the request, and the provider service mapping converts the order into a Level 1 report automatically
02. A TPR manager is reviewing a new due diligence request in the Vendor Management Workspace before approving it. The IRQ assessor recorded on the request has just moved to another business unit, and the manager knows who now runs the service.
How can the manager make sure the IRQ goes to the right person?
a) Change the Assignment group so that the new person is notified of the IRQ
b) Name the new person as the Contract negotiator, who answers the IRQ in that case
c) Specify the new person as IRQ assessor
d) Add the new person as the engagement contact, who then answers the IRQ
03. During the Contract Risk process, the contract negotiator has successfully executed the contract with the third party. The business owner, the approvers and the request owner all need to learn the contract's status without anyone sending messages by hand.
What should the contract negotiator do?
a) Select Discuss on the request and send the status to each stakeholder
b) Upload the contract and specify that it is executed
c) Attach the signed contract to the third-party record's attachments
d) Ask the TPR manager to email the stakeholders once the contract is filed
04. A TPR admin names a risk director as a specific approver in an approval rule. When a due diligence request reaches Awaiting approval, the director receives the approval email but cannot complete the approval.
Which change lets the director approve the request?
a) Add the director to the Contract risk negotiators group
b) Add the director to the Due diligence request assigners group
c) Add the director to the Third-party Risk Reviewers group
d) Add the director to the Third-party Risk Managers group
05. During due diligence on a logistics third party, the team learns that an individual who is not the company's registered or legal owner effectively controls its decisions and finances. The TPR manager wants this person's risks, such as hidden ownership, recorded against the relationship.
Which TPRM record type fits this individual?
a) A fourth-nth party linked to the third party, because the individual supplies it under a separate contract
b) A third-party element for the beneficial owner
c) A third-party contact who answers the external questionnaires in the Third-party portal
d) A subsidiary of the third party, so that the individual's ratings roll up into the third party's score
06. A TPR manager creates a new event-driven management rule with the On-demand run type, intended for reassessing engagements when a business unit asks. The rule is saved and has not been edited since. A week later, the manager opens it and selects Run now.
What happens?
a) Nothing is sent, because only active rules with a Run status of Ready are able to run
b) Nothing is sent until the manager selects Active, after which it runs on its Start date
c) The rule runs, then switches to Recurring so that later runs need no manual start
d) The rule runs, since an On-demand rule can run whether it is active or not
07. After enabling the Smart Assessment Engine, a TPR admin migrates the three Classic questionnaire templates used by the "Cloud hosting onboarding" assessment template. Every migration record shows a Migration Status of Completed. The admin reviews and publishes two of the migrated templates, and the third is still under review. The assessment template is not marked Supports smart assessment.
Which two statements explain this?
(Choose two.)
a) An assessment template is marked only when all its questionnaire templates are published
b) Migrated templates start in Draft, and a Completed migration status does not publish them
c) The marking waits for an event-driven management rule to run against the assessment template
d) Supports smart assessment has to be selected by hand on each migrated assessment template
08. A TPR assessor is drafting sign-in instructions for the third-party contacts at a new supplier. The draft tells the contacts to sign in at https://acme.service-now.com, the address that internal staff use.
Where should the instructions send the contacts instead?
a) To Employee Center, where due diligence is requested
b) To the GRC portal, where SAE assessment respondents answer their questionnaires
c) To the Third-party portal, at the instance URL followed by /svdp
d) To the Vendor Management Workspace on the same instance address
09. On this instance, TPR assessors are already permitted to answer external questionnaires for third-party contacts. A contact who is traveling asks an assessor to enter the answers to an external questionnaire on the contact's behalf, and the assessor navigates to All > Self-Service > Third-party risk management > External risk assessments > All open.
The documented procedure for responding to a questionnaire on behalf of a third-party contact starts from an assessment in which state?
a) Submitted to third party
b) Generating observations, while issues are open
c) Responses received, while the risk team reviews the answers
d) Finalizing with a third party, before it closes
10. An approver opens a due diligence request whose Risk ratings section shows an Inherent assessment rating of High, a Risk intelligence rating of Low and a Third-party assessment rating of Moderate. The business owner argues that the engagement is low risk because the vendor's own questionnaire answers say so.
Which reading of these fields is accurate?
a) Low reflects the external assessment answers, and Moderate comes from a risk intelligence provider
b) High reflects the external assessment answers, and Low is the result of the IRQ
c) Moderate is the IRQ result, and High is a risk intelligence score
d) Moderate reflects the external assessment answers, and Low is provider data