Risk Issues and Processes
About 13% of the CIS-TPRM exam — see all 7 domains.
Issues
A vendor risk issue captures a problem surfaced by an assessment, an observation, or monitoring. Creating a new issue requires: name, description, category, priority, and the related third party or engagement.
Remediation tasks and the issue workflow
Once an issue is analyzed, remediation tasks/actions are generated, assigned to the third party as needed, and tracked through issue execution → internal review → closure. The conceptual issue workflow follows New/Analyze → (work) → Review → Closed Complete.
Tasks
Tasks can be associated with a specific assessment or a specific issue. In the Risk tab of the Vendor Risk Management Workspace, you can view all tasks tied to third parties/engagements along with their status.
Continuous monitoring drives issues
SAE event-driven rules and external rating-feed thresholds can automatically create issues — for example, generating an issue when a vendor's external cyber score drops below a configured threshold (see Domain 6).
Sample questions from this domain
Three of the 39 in this domain, with the reasoning. The full set is in the question bank.
In VRM, what does a vendor risk issue represent?
- A. An identified risk or deficiency related to a vendor that requires tracking and remediation ✓
- B. An internal employee's timesheet
- C. A vendor's marketing campaign
- D. A scheduled platform upgrade
Why: A vendor risk issue captures an identified risk/deficiency tied to a vendor that must be tracked and remediated. It is not an upgrade, marketing campaign, or timesheet.
What is the typical relationship between a vendor risk issue and the tasks created under it?
- A. Tasks replace the need for the issue record
- B. Each issue can have only one task forever
- C. Tasks represent the discrete remediation actions tracked under the parent issue ✓
- D. Tasks are unrelated objects that cannot link to an issue
Why: Tasks are the discrete remediation actions tracked beneath the parent issue, enabling granular progress. Tasks are related to issues, an issue can have multiple tasks, and tasks complement rather than replace the issue.
Which of the following can trigger the creation of a vendor risk issue?
- A. A scheduled database backup
- B. A successful portal login
- C. A vendor updating their logo
- D. A finding from a completed assessment that indicates unacceptable risk ✓
Why: Assessment findings indicating unacceptable risk commonly trigger issue creation. Logo updates, successful logins, and backups do not create vendor risk issues.