FRM Part II · FRM Exam Part II

Case Study: Third-party Risk Management: formula sheet

Full chapter guide

Key formulas

Scope relationship: Outsourcing ⊂ Third-party relationships; Every outsourcing arrangement is a third-party relationship, but many third-party relationships (e.g. buying standard goods) are not outsourcing.
Accountability rule: Activity can be transferred; accountability cannot; The board and senior management remain accountable for outsourced activities and their risks.
Risk grouping: Third-party risk = operational + concentration + reputational (+ compliance, legal, data, exit); A classification, not a numerical formula. Use it to label the risk in a scenario.
Concentration test: Concentration exists when one provider supports many critical functions, or many firms depend on one provider; Firm-level and sector-level concentration are different. Both matter.
Lifecycle order: Due diligence → Contracting → Ongoing monitoring → Performance review → Exit planning; Exit planning should begin at the planning and contracting stages, not when the relationship is already failing.
Proportionality rule: Depth of control ∝ criticality and risk of the service; Critical services get deeper diligence, tighter terms, more frequent monitoring and tested exit plans.
Accountability rule: Outsourcing transfers the activity, not the accountability; The bank and its board remain responsible to customers and supervisors.
Service level check: Actual performance vs SLA target → breach, escalation, remediation or exit; Use agreed key performance and key risk indicators, not impressions.
Accountability rule: Outsourcing the activity ≠ outsourcing the responsibility; The bank and its board remain accountable to supervisors and customers.
Lifecycle of US interagency guidance: Planning → Due diligence → Contract negotiation → Ongoing monitoring → Termination; Use this order to place any question in the right stage.
Three lines of defense: 1st: own and manage | 2nd: oversee and challenge | 3rd: independent assurance; Audit is the third line; risk and compliance are the second.
Risk-based proportionality: Depth of oversight ∝ criticality and risk of the arrangement; Critical activities get the most board attention, testing and exit planning.
Third-party vs fourth-party: Third party = direct contract with you; Fourth party = subcontractor of your third party; Fourth parties are usually outside your contract, so you rely on the third party's oversight and your contract's flow-down terms.
Firm-level concentration share: Dependency share = Critical services using provider ÷ Total critical services; An illustrative internal metric, not a Basel-mandated formula. Use it to compare dependencies against a limit.
Concentration index (HHI): HHI = Σ (market share of provider i)²; Shares as fractions give a value up to 1. Higher means more concentrated. Useful for sector-level dependence.
Cloud shared responsibility: Provider secures the cloud; you secure what you put in the cloud; Accountability for the outsourced function stays with the bank.
Core control set: Map → Assess → Contract → Monitor → Exit-test; A memory aid for the lifecycle controls, not a regulatory formula.
Tolerance breach test: Breach if (time to restore service) > (impact tolerance); Measure from the start of disruption to restoration of the critical service, not just of the vendor system.
Recovery time against tolerance: Time to restore = detection time + decision time + failover or recovery time; Detection and decision delays often take up most of the tolerance. Check every component.
Resilience mapping chain: Critical service → people, process, technology, data, facilities → third and fourth parties; A service is only as resilient as its weakest mapped dependency.
Concentration indicator: Share of critical services relying on one provider = services using provider ÷ total critical services; A high share signals concentration risk. No universal threshold exists, so use the firm's own limits.
Tolerance vs appetite: Impact tolerance assumes disruption occurs; risk appetite governs likelihood and size of risk taken; Do not treat the two as interchangeable.
Risk tier logic: Inherent risk = impact of failure × likelihood; Residual risk = inherent risk after vendor controls; Tier mainly follows criticality and impact. Good controls reduce residual risk but do not make a critical vendor non-critical.
Availability SLA: Availability (%) = (Total time − Downtime) ÷ Total time × 100; Check the measurement period and whether planned maintenance is excluded.
KRI threshold rule: Green: within appetite; Amber: early warning; Red: breach, escalate; Set thresholds before use and link each to a named owner and action.
Recovery objectives in SLAs: RTO = maximum tolerable time to restore; RPO = maximum tolerable data loss measured in time; Vendor RTO and RPO must fit the firm's own tolerances for the service.

Quick revision

Outsourcing moves the activity, not the accountability.
The lifecycle runs from planning and due diligence to contracting, monitoring and exit.
Due diligence comes before the contract, and monitoring continues after it.
Criticality decides how deep the assessment and monitoring go.
The board sets risk appetite; management implements it; the first line owns the relationship day to day.
The risk function provides independent oversight and challenge.
Concentration risk arises when many services or many firms depend on the same provider.
A fourth party is a provider's own subcontractor, and the firm needs visibility of it.
Cloud use follows a shared responsibility model, so the firm still secures its own data and configuration.
Contracts should cover service levels, audit and access rights, incident notification, data protection and termination support.
An exit strategy and tested contingency plan reduce the damage of a provider failure.
Operational resilience asks whether critical services stay within impact tolerance during disruption.

Common mistakes

Treating third-party risk and outsourcing as identical terms. Fix: Remember third-party is the wider set. Outsourcing is the part where an activity is handed over.
Saying outsourcing transfers the risk to the provider. Fix: Contracts can allocate some financial loss, but regulatory accountability and customer impact stay with the firm.
Believing outsourcing transfers risk and responsibility to the vendor Fix: Remember that the bank stays accountable. Contracts can allocate cost and liability, but not regulatory responsibility.
Treating due diligence as a one-time event Fix: Diligence is refreshed periodically and on trigger events, with frequency based on criticality.
Saying the vendor takes on the regulatory responsibility once a contract is signed. Fix: Remember that the bank is always responsible. A contract can allocate costs, not remove the bank's duty.
Placing third-party monitoring as the main job of internal audit. Fix: The first line monitors day to day. The second line challenges. Audit gives independent assurance on the whole framework.
Treating fourth parties as having a contract with the bank. Fix: Fourth party means the provider's subcontractor. Control comes through the third party and contract flow-down terms.
Thinking multi-region cloud removes concentration risk. Fix: Multi-region protects against local faults. Provider-wide outages, shared software flaws or account-level issues remain. Only a different provider or tested exit addresses them.
Treating impact tolerance as risk appetite Fix: Tolerance is the maximum acceptable disruption once failure has occurred. Appetite is about the risk taken before it occurs.
Assuming outsourcing transfers responsibility to the vendor Fix: The firm and its board stay accountable for the service and its resilience. Contracts cannot transfer that.

Exam tips

Expect scenario questions where a provider fails. Name the risk type first, then the control.
Memorise that accountability stays with the board and senior management. This resolves many options at once.
Watch for words like 'eliminates', 'fully transfers' or 'always'. These are usually wrong.
Separate firm-level concentration (one provider, many functions) from sector-level concentration (many firms, one provider).
Link the activity's criticality to the strength of oversight. Proportionality is a frequent correct answer.
Always name the lifecycle stage first. Most wrong options are right actions at the wrong stage.
Watch for the words critical or material. They signal deeper controls and tested exit plans.
Reject any option that says risk or accountability moves to the vendor.