The Certified Third Party Risk Professional (CTPRP) shows that you can design and run a third-party risk management program. This guide covers who can take it, how the exam works, what each domain tests, what it costs and how to prepare.
CTPRP at a glance
| Detail | CTPRP |
|---|---|
| Awarded by | Shared Assessments |
| Level | Intermediate (CTPRA is the advanced, assessor-focused credential) |
| Questions | 120, worth up to 125 points |
| Time | 3 hours |
| Passing score | 70% of the available points |
| Format | Closed-book, online with a remote proctor (Proctor360) |
| Training | Required: self-study or instructor-led course, included in the price |
| Experience | 5 years in risk management (waivers available) |
| Valid for | 3 years, with 36 CPE credits and a $100 annual fee |
Who the CTPRP is for
Shared Assessments describes the CTPRP as an intermediate-level credential for professionals with direct or indirect responsibility for third-party risk management. If your work involves running, designing or contributing to a third-party or vendor risk program, it is aimed at you.
Eligibility
Shared Assessments asks for at least 5 years of experience as a risk management professional. That experience can come from third-party risk management, audit, compliance or risk and control assessment. Two waivers can each reduce the requirement by one year:
- a relevant bachelor’s or master’s degree in information security or IT
- an active professional certification, for example CISA, CISSP, CIPP or CIPM
If you pass the exam before you meet the experience requirement, you are awarded Associate CTPRP. It upgrades to the full CTPRP at no cost once you have the experience, as long as you keep the credential active.
How to get certified, step by step
- Choose a training option. The course and the exam are sold together; there is no exam-only option.
- Complete the course. The instructor-led version runs as two 5-hour web sessions; the on-demand version is a six-course, self-paced program of about 8–10 hours. The course earns 12 CPE credits.
- Sit the exam within 15 weeks of the course start date, online with a remote proctor.
- Apply within 30 days of passing, with a proof-of-experience form and the contact details of someone who can confirm your employment.
- Receive your badge. Review takes up to two weeks, and the credential is issued as a Credly digital badge.
The exam format
The exam has 120 questions worth up to 125 points, and you have 3 hours. It is closed-book. Most questions are short scenarios of two or three sentences with one correct answer; others ask which statement is true or which definition fits best. Watch for wording such as NOT, EXCEPT and MOST, which changes what the question is asking. You can skip a question and come back to it. Final results arrive within two weeks.
Booking tip: the exam runs through Proctor360. You install a Chrome extension, show photo ID and complete a 360° scan of your room before you start. Booking, changing or cancelling within 48 hours of the slot costs $15, so book early.
The four CTPRP domains
Since March 2025 the four domains carry equal weight. This is how the official exam prep guide describes them, in brief:
| Domain | Weight | What it covers |
|---|---|---|
| Third-Party Risk Management Foundation | 25% | Outsourcing terms and risk triggers, the TPRM lifecycle, data classification and governance, and how TPRM fits enterprise risk management: risk appetite, inherent and residual risk. |
| TPRM Program Design and Structure | 25% | Governance and accountability, policies, risk tiering and vendor classification, contract provisions, due-diligence scope and the assessment process: scoping, assurance reports and testing methods. |
| Controls Evaluation in TPRM | 25% | Governance, risk and compliance controls, including HR security; information protection (access, physical, network, application and cloud); IT operations and resilience (change and patch management, business continuity and disaster recovery); and cybersecurity and technology governance (incident response, threat and vulnerability management). |
| TPRM Program Operations and Implementation | 25% | Reporting after an assessment, corrective action plans, risk acceptance, ongoing monitoring, managing program data and workstreams, and measuring program performance: metrics, staffing and independent reviews. |
The official exam prep guide describes these domains in terms of concepts and practice; it does not list specific regulations or industry questionnaires as exam content.
What changed in 2025
The handbook and exam prep guide published in March 2025 changed the exam in three ways:
- the exam went from 125 questions worth 140 points to 120 questions worth 125 points
- the domain weights went from 25 / 25 / 30 / 20 to 25% each, so Controls Evaluation lost weight and Operations gained it
- the official practice material changed from one 50-question exam to two 40-question exams
Study material written before March 2025 may still describe the old format.
What the CTPRP costs
Prices at the time of writing (October 2026) are listed as a limited-time offer; check the official page before you buy.
| Option | Shared Assessments member | Non-member |
|---|---|---|
| Self-study course and exam | $595 (regular $995) | $695 (regular $1,295) |
| Instructor-led course and exam | $795 (regular $1,195) | $995 (regular $1,495) |
The price includes the course, the exam, the study materials and the digital badge. A retake costs $150, with up to three attempts; after a third unsuccessful attempt you need to retake the course, at half price.
How to prepare
Shared Assessments recommends about 30 hours of study. This is our suggested four-week plan, following the four domains:
- Week 1: Foundation and program design. The TPRM lifecycle, risk appetite, inherent versus residual risk, risk tiering, and what belongs in a contract.
- Week 2: Controls evaluation. Access, network, application and cloud controls; change and patch management; continuity and disaster recovery; incident response.
- Week 3: Operations. Assessment reporting, corrective action plans, risk acceptance, monitoring and program metrics.
- Week 4: Practice and review. Take full-length timed practice exams, then go back over every domain where you score below 75%.
On exam day, read each scenario carefully and slow down on questions worded with NOT, EXCEPT or MOST, which reverse or narrow what is being asked.
Keeping your CTPRP active
The credential runs on a three-year term. You need 36 CPE credits per term (about 12 a year is recommended, and credits from other organisations count), a $100 annual maintenance fee, and adherence to the Shared Assessments code of ethics. If it lapses for less than two years you can reinstate it by paying the outstanding fees and completing the missing CPE credits; after two years you need to take the course and exam again.
CTPRP or CTPRA?
Shared Assessments also offers the Certified Third Party Risk Assessor (CTPRA), an advanced-level credential for people who scope and test a third party’s controls, such as assessors and auditors. The exam profile is the same (120 questions, 3 hours, 70%), but the content focuses on performing assessments. If you run or build the program, start with the CTPRP; if your job is carrying out the assessments, the CTPRA is the closer fit.
I run ExamCrest, where this guide first appeared. Try free CTPRP practice questions: https://examcrest.com/exam/ctprp/free-questions?utm_source=devto&utm_campaign=ctprp-guide-copy
Top comments (0)