Which statement BEST describes the methods of performing due diligence during third party risk assessments?

A fundamental principle of third-party risk management (TPRM) is that due diligence activities should be risk-based and proportionate to the level of risk a third party presents. Not all vendors require the same level of scrutiny. High-risk vendors handling sensitive data may warrant onsite assessments, penetration tests, and extensive control reviews. Conversely, low-risk vendors may only require a lightweight questionnaire and a review of existing certifications. This tailored, risk-based approach allows an organization to focus its resources efficiently and effectively on the most significant threats, ensuring that the depth of the assessment matches the potential impact of a control failure.

A. Requiring onsite assessments for all vendors is not scalable, cost-effective, or necessary for low-risk relationships.

B. Questionnaires (like the SIG) are a primary tool, but they are not the only method and may be insufficient for high-risk vendors.

D. Relying solely on public records is generally insufficient for any level of risk, as it provides no insight into internal controls.

1. Shared Assessments Program. (2023). Certified Third Party Risk Professional (CTPRP) Body of Knowledge. Domain 3: Performing Third Party Risk Assessments, Section 3.1: Scoping Assessments and Selecting Assurance Procedures.

2. Office of the Comptroller of the Currency (OCC). (2013, October 30). OCC Bulletin 2013-29: Third-Party Relationships: Risk Management Guidance. Page 10, "The level of due diligence should be commensurate with the level of risk..."