Which metrics are commonly used to measure the effectiveness of a third-party risk management program?

• A. Timely risk assessments, remediation time, up-to-date attestations, and incident rates.
• B. Number of vendors, geographic diversity, contract length, audit costs.
• C. Employee headcount, training hours, vendor visits, travel time.
• D. Data volume, storage cost, latency, uptime.

Answer: (A)

Measuring how well a third-party risk management program works hinges on metrics that show risk is being identified, mitigated, and monitored, and that real-world risk are being reduced. The best choice includes timely risk assessments (how quickly risks from vendors are identified and evaluated), remediation time (how fast gaps are closed and controls strengthened), up-to-date attestations (ongoing evidence that vendors maintain required controls), and incident rates (what actually happens in terms of vendor-related security or privacy events). Together, these metrics capture identification speed, remediation effectiveness, ongoing assurance, and actual outcomes, giving a clear picture of program performance. In contrast, the other options focus on counts, costs, or general IT metrics that don’t directly reflect the program’s effectiveness in managing third-party risk.