Virtual assessments are a method of conducting third party risk assessments remotely, using various tools and techniques to collect and verify information about the third party's controls, processes, and performance.
Virtual assessments can be used to evaluate various risk domains, such as information security, privacy, resiliency, and compliance, depending on the scope and objectives of the assessment. Virtual assessments can also be used to complement or supplement onsite assessments, especially when travel or access restrictions are in place.
One of the key components of virtual assessments is the use of interviews with subject matter experts (SMEs) from the third party, who can provide insights and clarifications on the third party's policies, procedures, practices, and evidence. Interviews can also be used to validate or confirm the understanding of key controls, and not just to review questionnaire responses. However, interviews are not the only way to perform controls evaluation and testing in virtual assessments. Other methods include:
* Requesting and reviewing documentation and artifacts from the third party, such as policies, standards, certifications, attestations, test results, audit reports, or incident logs, that demonstrate the implementation and effectiveness of the controls.
* Performing live or recorded demonstrations of the controls, such as showing how the third party monitors, detects, and responds to security incidents, or how the third party encrypts, backs up, and restores data.
* Using remote access tools or platforms, such as screen sharing, video conferencing, or web portals, to observe and verify the controls in action, such as checking the configuration settings, access rights, or patch levels of the third party's systems or applications.
* Using independent or external sources of information, such as ratings, benchmarks, or feedback, to validate and compare the third party's performance, compliance, or reputation.
Therefore, the statement that virtual assessments include using interviews with SMEs since controls evaluation and testing cannot be performed virtually is false, as there are other ways to perform controls evaluation and testing in virtual assessments, besides interviews.
References:
* 1: Shared Assessments, a leading provider of third party risk management solutions, offers a comprehensive guide for Certified Third Party Risk Professional (CTPRP) candidates, which covers the core concepts and best practices of third party risk management, including virtual assessments.
* 2: Schneider Downs, a professional services firm, provides a blog post on the best practices for conducting third party risk management virtual assessments, which includes the methods and steps for performing controls evaluation and testing remotely.
* 3: Shared Assessments, a leading provider of third party risk management solutions, offers a blog post on the value and challenges of virtual assessments, which includes the benefits and drawbacks of using interviews and other techniques for controls evaluation and testing.

A network access policy is a set of rules and conditions that define how authorized users and devices can access the network resources and services of an organization. It typically includes the following elements12:
* Firewall settings: These are the rules that control the incoming and outgoing network traffic based on the source, destination, protocol, and port of the packets. Firewall settings help to protect the network from unauthorized or malicious access, and to enforce the network security policy of the organization.
* Unauthorized device detection: This is the process of identifying and preventing unauthorized devices from accessing the network. Unauthorized devices can pose a security risk to the network, as they may not comply with the security standards and policies of the organization, or they may be compromised by malware or hackers. Unauthorized device detection can be done by using various methods, such as network access control (NAC), network admission control (NAC), or 802.1X authentication.
* Remote access: This is the ability of authorized users to access the network resources and services of the organization from a remote location, such as a home office, a hotel, or a public hotspot. Remote access can be provided by using various technologies, such as virtual private networks (VPNs), remote desktop services (RDS), or remote access services (RAS). Remote access requires a secure and reliable connection, and it must comply with the network access policy of the organization.
* Website privacy consent banners: These are the messages that appear on websites to inform the visitors about the use of cookies and other tracking technologies, and to obtain their consent for such use.
Website privacy consent banners are part of the website privacy policy, which is a legal document that discloses how the website collects, uses, and protects the personal data of the visitors. Website privacy consent banners are not related to the network access policy of the organization, as they do not affect how the users and devices can access the network resources and services of the organization.
Therefore, the correct answer is C. Website privacy consent banners, as they are typically not included within the scope of an organization's network access policy. References:
* 1: Network Policy Server (NPS) | Microsoft Learn
* 2: Network Access Policy | University Policies

According to the CTPRP Job Guide, the TPRM program should establish minimum risk assessment standards for third party due diligence based on the company's risk tolerance and risk appetite. This means that the TPRM program should define the scope, depth, frequency, and methodology of the risk assessment process for different categories of third parties, taking into account the potential impact and likelihood of various risks.
The risk assessment standards should be consistent, transparent, and aligned with the company's strategic objectives and regulatory obligations. The TPRM program should also monitor and update the risk assessment standards as needed to reflect changes in the business environment, risk profile, and best practices. The other options are not correct because they do not reflect a holistic and risk-based approach to third party due diligence. Setting the standards by each business unit may result in inconsistency, duplication, or gaps in the risk assessment process. Defining the standards in the contract or statement of work may limit the flexibility and adaptability of the risk assessment process to changing circumstances. Identifying the standards by procurement may overlook the input and involvement of other stakeholders and functions in the risk assessment process. References:
* CTPRP Job Guide, page 17
* Third-Party Risk Management and ISO Requirements for 2022, section "Benefits of Implementing Risk Management"
* Managing third-party risk through effective due diligence, section "Complying with regulators' demands"
* Third-Party Due Diligence Checklist: 3 Essential Steps, section "Step 2: Conduct a Risk Assessment"

it is the most appropriate and compliant method of validating pre-employment screening attributes among the given options. Requesting evidence of the performance of pre-employment screening when permitted by law means that the organization respects the legal and regulatory boundaries of different jurisdictions and does not impose unnecessary or unlawful requirements on its third parties. It also ensures that the organization obtains relevant and reliable information about the third parties' screening processes and outcomes, which can help assess their suitability and risk level.
The other options are incorrect because they are either inappropriate or ineffective methods of validating pre-employment screening attributes. Reviewing evidence of web search of social media sites (A) is inappropriate because it may violate the privacy and data protection rights of the third parties and their employees, as well as expose the organization to potential bias and discrimination claims. Providing and sampling complete personnel files to demonstrate unique screening results (B) is ineffective because it may not reflect the actual screening attributes of the third parties, as they may have different screening criteria, standards, and methods than the organization. Requiring evidence of drug testing is inappropriate because it may not be relevant or necessary for the nature and scope of the third-party relationship, and it may also conflict with the laws and regulations of different jurisdictions that prohibit or limit such testing. References:
https://www.onetrust.com/blog/third-party-risk-management/

The purpose of internal communications and information sharing using TPRM performance metrics is to inform and align the organization's stakeholders on the status, progress, and outcomes of the TPRM program.
This includes communicating the results of vendor assessments, the compliance level of the organization's policies and procedures, and the periodic reporting to management and other relevant parties. However, documenting the corrective action plan between external parties is not an internal communication, but rather an external one. This is because the corrective action plan is a formal agreement between the organization and the vendor to address and resolve the issues identified in the assessment. Therefore, this statement is not an example of the purpose of internal communications and information sharing using TPRM performance metrics. References:
* 15 KPIs & Metrics to Measure the Success of Your TPRM Program
* Third-party risk management metrics: Best practices to enhance your program
* 3 Best Third-Party Risk Management Software Solutions (2024)