Procedures in third party risk management refer to what?

• A. What you are to do to implement your policies (implementation guidelines)
• B. The standards you must meet
• C. The governance structure
• D. The roles of the board

Answer: (A)

Procedures are the step-by-step actions you take to put your policies into practice. They translate high-level rules into concrete tasks, detailing who does what, when, and how, and outlining the workflows, controls, documentation, and escalation paths needed to run third-party risk activities consistently.

This is why the best fit describes implementation guidelines—it's about the actionable processes that actually carry out the policies. Standards define the required benchmarks you must meet, governance structure covers who has authority and how decisions are made, and the board’s roles relate to oversight and strategic direction. None of those describe the everyday steps to implement policies the way procedures do.