Dashboards and Reports
About 5% of the CIS-TPRM exam — see all 7 domains.
Vendor Management Workspace
Open Workspaces > Vendor Management Workspace and select the Risk tab. Pages: Home (Third-party risk overview, quick actions, Risk rating by risk tiers, Top risk areas, Issues by priority, Fourth-nth party overview), Due diligence management, Risk activity, Dashboards, Risk concentration map, Task, Unified content management, and List.
Dashboards
The Dashboards page holds the Third-party insights and TPRM custom analytics dashboards. TPR managers and TPR admins can edit them; TPR assessors and reviewers see the responses assigned to them. Teams can create and share additional dashboards.
Legacy Vendor Risk Overview
The Vendor Risk Overview page (All > Third-party Risk Management > Overview) is a legacy view, replaced by the third-party risk reports in the Vendor Management Workspace; the dashboard is deprecated from version 18.1.3 and remains only on instances installed before that version.
Sample questions from this domain
Three of the 14 in this domain, with the reasoning. The full set is in the question bank.
What is the primary purpose of TPRM dashboards?
- A. To give internal stakeholders visibility into third-party risk posture and program metrics at a glance ✓
- B. To let third-party contacts track their own risk ratings and open issues from the Third-party portal
- C. To configure the risk rating scales and scoring rules that calculate third-party and engagement ratings
- D. To send questionnaires to third parties on a schedule that each dashboard owner sets on the dashboard
Why: TPRM dashboards (Third-party insights and TPRM custom analytics in the Vendor Management Workspace) give internal stakeholders an at-a-glance view of third-party risk posture and program metrics. They are internal workspace pages, not Third-party portal views. Risk rating scales and scoring rules are configured in assessment setup, not on dashboards. Questionnaires are sent through assessments and rules such as event-driven management rules, not dashboard schedules.
Which metric would most likely appear on a TPRM program dashboard?
- A. Number of open incidents by assignment group
- B. Average change request approval time
- C. Number of discovered CIs by CMDB class
- D. Number of third parties by risk rating ✓
Why: Third parties by risk rating is a typical TPRM program metric (Zurich renamed the Tier-level column to Risk rating). Incident counts by assignment group, change approval time, and discovered CIs by class are real platform metrics, but they belong to IT service and configuration management dashboards, not third-party risk.
Which TWO reports are commonly valuable in a TPRM program? (Choose two)
- A. Open incidents by assignment group
- B. Change requests by risk and impact
- C. Overdue assessments by third party ✓
- D. Discovered configuration items by class
- E. Open third-party risk issues by priority ✓
Why: Overdue-assessment and open-issues-by-priority reports give actionable program insight (TPRM issues carry a Priority field, and the workspace reports open issues by priority). Incidents by assignment group, change requests by risk and impact, and discovered configuration items by class are IT service and configuration management reports, not TPRM program reporting.