At which level of reporting are changes in TPRM program metrics rare and exceptional?

Reporting at the Strategic/Board level focuses on the overall health and maturity of the TPRM program, aligned with the organization's risk appetite. Metrics presented are high-level, aggregated Key Risk Indicators (KRIs) and Key Performance Indicators (KPIs) that demonstrate program effectiveness over the long term. These metrics are designed for stability to facilitate strategic decision-making. Therefore, changes are infrequent and exceptional, typically reflecting a significant shift in the risk environment, a major incident, or a fundamental change in business strategy, rather than routine operational fluctuations.

A. Operational Level: Metrics change frequently at this level as they track day-to-day activities, such as the status of individual assessments and remediation tasks.

B. Tactical Level: This level monitors trends and performance against quarterly or monthly goals, so metrics change more regularly than at the strategic level.

C. Management Level: Similar to the tactical level, management reporting involves regular updates on team performance and risk trends, leading to frequent metric changes.

1. The Shared Assessments Program, "Third-Party Risk Management: A Primer for the Board of Directors," 2021. Page 5 discusses the Board's oversight role, which relies on "high-level dashboards and summary reports" focusing on "the most significant third-party risks." This implies metrics are stable and changes are noteworthy.

2. CTPRP Certification Courseware, Module on Program Governance and Reporting. The curriculum describes a reporting hierarchy where strategic/board-level reports contain aggregated, trend-based data that changes infrequently, while operational reports are dynamic and detailed.