Risk Issues and Processes
About 13% of the CIS-TPRM exam — see all 7 domains.
Issues
A third-party risk issue [sn_vdr_risk_asmt_issue] (number prefix VRI) records a concern that must be remediated. The issue form has Name, Description, Applies to (third party, engagement, or element), Third party, Assessment, State, Priority, Assignment group, Assigned to, Third-party contact, Watch list, Visible in third-party portal, and a Recommendation (Third party to remediate, Accept issue, or Request additional information) with an Explanation. Issues are created manually by a TPR assessor (optionally from a template), automatically by issue generation rules, or by provider-based submission rules.
Remediation tasks and closure
Tasks [sn_vdr_risk_asmt_task] (prefix VRT or VRIT) can be associated with a third party, engagement, element, assessment, or issue. External tasks go to third-party contacts and can be shown in the portal; internal tasks go to internal users and never appear in the portal. Task states: Open, Submitted to respondent (internal) or Submitted to third party (external), Work in progress, Review, Closed complete, Closed incomplete, Closed cancelled. Tasks carry planned start and end dates, and the issue page shows tasks by planned end date. On the external assessment, the issue risk rating uses the priority of closed issues and how they were resolved.
Monitoring drives issues
When a risk intelligence provider's rating changes, a provider-based submission rule can create an issue, task, assessment, or email. Issue generation rules create issues from questionnaire responses.
Sample questions from this domain
Three of the 39 in this domain, with the reasoning. The full set is in the question bank.
In Third-party Risk Management (TPRM), what does a third-party risk issue represent?
- A. An identified risk or deficiency related to a third party or engagement that requires tracking and remediation ✓
- B. A discrete unit of remediation work assigned to an internal user or a third-party contact under a parent finding
- C. A request sent to a third-party contact to complete a questionnaire or upload the requested documents
- D. A scored assessment result that rolls the risk area ratings up into the third party's overall rating
Why: A third-party risk issue (number prefix VRI) captures an identified risk or deficiency that applies to a third party, an engagement, or a third-party element and must be tracked and remediated. A discrete unit of remediation work under a parent finding is a third-party risk task (VRT or VRIT), not the issue. A request for questionnaire or document responses is a questionnaire request or document request within an external assessment. Rolling risk area ratings into an overall rating is what the external assessment's scoring does.
What is the typical relationship between a third-party risk issue and the tasks created under it?
- A. Tasks are the assessment questions behind the issue, which the issue lists on its Questions tab
- B. An issue can hold only one task, so each additional remediation action needs a separate issue
- C. Tasks represent the discrete remediation actions tracked under the parent issue ✓
- D. Tasks are the parent records, and each issue records one finding under a task
Why: Tasks are the discrete remediation actions tracked under the parent issue: the task form has an Issue field, and the issue's Tasks tab lists every associated task with its count and status. The Questions tab lists the assessment questions associated with the issue, which are not tasks. An issue can have several tasks, so one issue per action is unnecessary. The hierarchy runs from issue to task, not the reverse.
Which of the following can trigger the creation of a third-party risk issue?
- A. A third-party contact delegating part of a questionnaire to a contributor in the portal
- B. A TPR approver approving the due diligence request for a new engagement
- C. A tier-based rule scheduling the next periodic external assessment for an engagement
- D. A finding from a completed assessment that indicates unacceptable risk ✓
Why: Assessment findings that indicate unacceptable risk trigger issues, either created manually by a TPR assessor or generated automatically by issue generation rules when the assessment moves to Generating observations. Delegating questions to a contributor is a portal response activity, approving a due diligence request moves the request toward contract and activation, and a tier-based rule creates assessments rather than issues.