Shared Assessments CTPRP Exam Questions

Change management is the process of controlling and documenting any changes to the scope, objectives, requirements, deliverables, or resources of a project or a program. Change management ensures that the impact of any change is assessed and communicated to all stakeholders, and that the changes are implemented in a controlled and coordinated manner. Compliance artifacts are the documents, records, or reports that demonstrate the adherence to the change management process and the regulatory or industry standards.

A robust change management process should include the following attributes:

Logging: This means that any change request or proposal is recorded in a change log or a change register, along with the details of the change initiator, the change description, the change category, the change priority, the change status, and the change history. Logging helps to track and monitor the progress and outcome of each change, and to provide an audit trail for compliance purposes.

Approvals: This means that any change request or proposal is reviewed and approved by the appropriate authority or stakeholder, such as the project manager, the sponsor, the customer, the steering committee, or the regulatory body. Approvals help to ensure that the change is justified, feasible, aligned with the project or program objectives, and acceptable to the affected parties.

Validation: This means that any change request or proposal is verified and tested to ensure that it meets the quality standards, the functional and non-functional requirements, and the expected benefits and outcomes. Validation helps to ensure that the change is implemented correctly, effectively, and efficiently, and that it does not introduce any errors, defects, or risks.

Back-out and exception procedures: This means that any change request or proposal has a contingency plan or a rollback plan in case the change fails, causes problems, or is rejected. Back-out and exception procedures help to minimize the negative impact of the change, and to restore the original state or the baseline of the project or program. They also help to handle any deviations or issues that may arise during the change implementation or the change review.

CTPRP Job Guide

An Agile Approach to Change Management

CM Overview

Management Artifacts and its Types

Achieving Regulatory and Industry Standards Compliance with the Scaled Agile Framework

8 Steps for an Effective Change Management Process

Risk registers are tools that help organizations document, monitor, and manage their third party risks. They typically include information such as the risk description, category, source, impact, likelihood, rating, owner, status, and action plan. Risk registers enable organizations to prioritize their risks, assign responsibilities, track progress, and report on their risk posture. According to the CTPRP Study Guide, 'A risk register is a tool for capturing and managing risks throughout the third-party lifecycle.It provides a comprehensive view of the organization's third-party risk profile and facilitates risk reporting and communication.'1Similarly, the GARP Best Practices Guidance for Third-Party Risk states, 'A risk register is a tool that records and tracks the risks associated with third parties.It helps to identify, assess, and prioritize risks, as well as to assign ownership, mitigation actions, and target dates.'2

CTPRP Study Guide

GARP Best Practices Guidance for Third-Party Risk

Threat modeling is a core element of the Microsoft Security Development Lifecycle (SDL) and a structured approach to identify, quantify, and address the security risks associated with an application12.Threat modeling helps to shape the application's design, meet the security objectives, and reduce risk1. The best time to perform threat modeling analysis is before the application design and development activities begin, as this allows the application service provider to:

Communicate about the security design of their systems1.

Analyze the design for potential security issues using a proven methodology1.

Suggest and manage mitigations for security issues1.

Incorporate security requirements into the design2.

Avoid costly rework or redesign later in the SDLC2.

Identify the most critical and relevant threats to focus on2.Reference:1: Microsoft Security Development Lifecycle Threat Modelling12: Threat Modeling Process | OWASP Foundation2

A risk register is a tool that records and tracks the identified risks, their probability, impact, status, and mitigation actions throughout the life cycle of a third-party relationship1.A risk register typically includes the following components2:

A unique identifier for each risk

A description of the risk and its source

A rating or grading of the risk according to a risk assessment table or hierarchy

An assessment of the impact and likelihood the risk will occur and the possible seriousness

An outline of proposed mitigation actions and assignment of risk owner

A status update on the risk and the progress of the mitigation actions

A target date for resolving the risk or closing the action A vendor inventory is a list of all the third parties that a banking organization engages with, along with relevant information such as the type, scope, and nature of the services provided, the contract terms and conditions, the performance indicators, and the risk ratings3. A vendor inventory is not a component of a risk register, but rather a separate document that supports the planning and due diligence phases of the third-party relationship life cycle. A vendor inventory may be prioritized by contract value, but also by other criteria such as the criticality of the service, the risk level of the vendor, and the strategic importance of the relationship.Reference:

1: Third-Party Risk Management (TPRM): Final Interagency Guidance, KPMG, June 2023

2: What Is Third-Party Risk Management (TPRM)? 2024 Guide, UpGuard, January 2024

3: Third-Party Risk Management Guidance, OCC Bulletin 2023-29, October 2023

[4]: Certified Third Party Risk Professional (CTPRP) Study Guide, Shared Assessments, 2023

[5]: Best Practices Guidance for Third-Party Risk, GARP, February 2023

Fourth-Nth party risk refers to the potential threats and vulnerabilities associated with the subcontractors, vendors, or service providers of an organization's direct third-party partners12. After contract signing and on-boarding due diligence is complete, the most important type of contract provision to manage Fourth-Nth party risk is subcontractor notice and approval.This provision requires the third party to inform the organization of any subcontracting arrangements and obtain the organization's consent before engaging any Fourth-Nth parties345. This provision enables the organization to have visibility and control over the extended network of suppliers and service providers, and to assess the potential risks and impacts of any outsourcing decisions.Subcontractor notice and approval also helps the organization to ensure that the Fourth-Nth parties comply with the same standards and expectations as the third party, and to hold the third party accountable for the performance and security of the Fourth-Nth parties345.Reference:

1: Understanding 4th- and Nth-Party Risk: What Do You Need to Know? | Mitratech

2: Understanding 4th- and Nth-Party Risk: What Do You Need to Know? | Mitratech Holdings, Inc - JDSupra

3: First, 2nd , 3rd , 4th, 5th Parties: How to Measure the Tiers of Risk

4: Managing 4th Party Risk with Vendor Insurance Verification - Evident ID

5: How to Write Fourth-Party Vendor Requirements Into the Contract - Venminder