FRM Part II · FRM Exam Part II

Guidance on Managing Outsourcing Risk: formula sheet

Full chapter guide

Key formulas

Accountability rule: Outsourcing the activity ≠ outsourcing the responsibility; The bank's board and senior management stay accountable for outsourced activities.
Scope relationship: Outsourcing ⊂ Third-party arrangements; Outsourcing is one type of third-party arrangement. Check the definition used in the question.
Main outsourcing risks: Operational, compliance, reputational, concentration, strategic; Learn these five and be able to match each to a scenario.
Drivers of outsourcing: Cost, expertise, scale, speed, focus on core business; Drivers explain why banks outsource. They are not risks themselves.
Accountability principle: Outsourced activity ≠ outsourced responsibility; The bank remains fully accountable to customers and regulators for outsourced services.
Board role: Board = set risk appetite + approve policy + oversee + challenge; Oversight and approval, not day-to-day management of providers.
Management role: Management = implement + assess + monitor + report + escalate; Executes within the board's appetite and informs the board of material issues.
Proportionality: Depth of controls ∝ materiality and criticality of the outsourced activity; Critical activities need stronger due diligence, monitoring, approval and exit planning.
Accountability principle: Responsibility for outsourced activity = bank's board and senior management (not transferable); Outsourcing moves the work, not the accountability. Expect this in many questions.
Lifecycle order: Risk assessment → materiality → due diligence and selection → contract → monitoring → exit; This topic covers the stages before the contract. Know the sequence.
Proportionality rule: Higher materiality ⇒ deeper due diligence, stronger contract terms, closer monitoring; Diligence is risk-based, not identical for every vendor.
Materiality drivers: Criticality of activity + data sensitivity + substitutability + size/volume + concentration; A checklist of factors, not a numeric formula. No single factor decides.
Accountability rule: Outsourcing the activity ≠ outsourcing the responsibility; The bank's board and senior management remain accountable for outsourced activities.
Clause-to-risk mapping: Service levels → performance risk; audit/access → oversight risk; subcontracting → fourth-party risk; data protection/confidentiality → information risk; termination/exit → lock-in and continuity risk; Use this to match a described failure to the missing clause.
SLA components: SLA = metric + target + measurement method + reporting frequency + remedy; A target with no measurement or remedy is weak.
Accountability rule: Outsourcing the activity ≠ outsourcing the responsibility; The board and senior management remain accountable for outsourced activities.
Proportionality rule: Monitoring intensity ∝ criticality (materiality) of the service; Critical services get more frequent, deeper monitoring and reporting.
KRI escalation logic: KRI value vs threshold: green (within appetite) → amber (early warning) → red (breach, escalate and act); Each threshold needs an owner and a predefined action.
SLA attainment: SLA attainment (%) = (measured performance ÷ target) × 100, or the share of periods meeting target; Use the SLA's own definition. For error measures, lower is better, so compare the actual to the maximum allowed.
Three lines of oversight: 1st line: business owner; 2nd line: risk and compliance; 3rd line: internal audit; Internal audit gives independent assurance and does not run day-to-day monitoring.
Recovery time objective (RTO) test: Provider's demonstrated recovery time ≤ bank's RTO for the critical service; If the provider's tested recovery is longer than your RTO, there is a gap to fix or accept formally.
Accountability rule: Outsourced activity ⇒ risk and accountability stay with the bank; You can outsource tasks, not responsibility.
Concentration share (simple indicator): Provider share = value of critical services (or exposure) on one provider ÷ total value of critical services; A high share signals concentration. There is no universal limit; the bank sets tolerances.
Exit plan scope: Exit plan = stressed exit + planned exit, each with transition route (new provider or insourcing), data return and timeline; Check that both exit types are covered.

Quick revision

Outsourcing risk is the risk of loss or disruption arising from a third party performing activities for the firm.
Responsibility cannot be outsourced. The firm stays accountable for the activity and its risks.
The board sets risk appetite and oversees the policy. Senior management implements it.
A risk management program covers the full life of the arrangement, not just selection.
Due diligence happens before the contract and looks at the provider's capability, financial strength, controls and resilience.
Contracts should define services, performance standards, audit and access rights, data protection, and termination terms.
Service level agreements set measurable performance standards that you can monitor.
Monitoring is continuous. It uses performance reports, issue escalation and periodic reassessment of the provider.
Critical or material outsourcing deserves stronger scrutiny than routine services.
Business continuity plans should cover provider failure and be tested.
An exit strategy lets the firm move the activity in-house or to another provider in an orderly way.
Concentration risk arises when many activities, or many firms, depend on one provider.

Common mistakes

Believing outsourcing transfers risk and accountability to the provider. Fix: Remember that the bank remains accountable to customers and supervisors. A contract can share financial loss at best.
Treating outsourcing and third-party risk as identical. Fix: Treat outsourcing as a subset of third-party arrangements, and follow the definition given in the question.
Believing a strong contract transfers responsibility to the provider. Fix: Remember that regulatory and customer accountability stays with the bank. A contract only supports recovery and control.
Giving the board day-to-day control of provider monitoring. Fix: The board oversees and challenges. Management monitors and reports.
Saying outsourcing transfers risk and responsibility to the provider. Fix: Remember that accountability stays with the board and senior management. The contract can allocate remedies, not the bank's regulatory responsibility.
Judging materiality by contract cost alone. Fix: Use criticality, data sensitivity, substitutability, scale and concentration. A cheap service can be critical.
Thinking outsourcing transfers accountability to the provider. Fix: Remember that the board and senior management stay accountable. The contract only supports control.
Treating an SLA as a general promise of good service. Fix: An SLA is measurable: metric, target, reporting and remedy. Vague wording is a weakness.
Believing the provider takes on the risk once the contract is signed. Fix: Remember that accountability stays with the bank's board and senior management. Only the task is delegated.
Treating monitoring as a one-time check at onboarding. Fix: Due diligence is before signing. Monitoring is continuous and runs through the contract life.

Exam tips

Expect scenario questions that ask you to match an event to a risk type. Practise the event-to-risk list until it is automatic.
Reject any option that says risk or accountability moves to the provider.
Read for words such as single provider, sector-wide dependence or exit difficulty. They signal concentration or strategic risk.
Separate drivers from risks. A question on why banks outsource wants cost, expertise, scale or speed, not risks.
Use the definition in the question stem for outsourcing versus third-party scope before choosing.
Scan options first for 'transfers responsibility' or 'liability moves to the provider'. These are almost always traps.
Use verbs: board sets, approves, oversees, challenges; management implements, monitors, reports, escalates.
Link depth of control to materiality. Critical activities get the most scrutiny.