Skip to content

FRM Part II · FRM Exam Part II

Case Study: Third-party Risk Management for FRM Part II

Third-party risk management is how a firm identifies, assesses, controls and monitors the risks that arise when vendors, outsourcers or cloud providers deliver services for it. In the exam, you read a case, spot the risk type, apply the lifecycle or a control, and pick the answer that keeps accountability with the firm.

What this chapter covers

This chapter is a case-based look at the risks a firm takes on when it relies on outside parties. These include vendors, outsourced service providers, cloud platforms and the providers behind them. It starts with why firms outsource and then follows a third party through its whole relationship with the firm: planning, due diligence, contracting, ongoing monitoring and exit.

The chapter then covers who owns the risk. The board, senior management, business owners and the risk function each have a role, and regulators expect the firm to stay accountable even when a task is outsourced. Later topics cover concentration, fourth-party and cloud risk, operational resilience when a provider fails, and the metrics and contract terms used to keep the risk within appetite.

This chapter sits inside the Operational Risk and Resilience topic of the paper. It links to operational risk event types, business continuity, impact tolerances and cyber risk. It also connects to Current Issues, where digital resilience and AI-related dependencies appear, and to liquidity and credit risk when a provider failure disrupts payments or funding.

The exam has 80 multiple-choice questions in 4 hours, and many are applied scenarios. Third-party risk suits that style: a short case, a failure, and a question about what the firm should have done. The ideas are conceptual, so you can earn marks with clear reasoning rather than heavy calculation. Once you know the lifecycle and the accountability principle, you can answer unfamiliar cases. The same logic also helps in neighbouring operational resilience questions.

Case Study: Third-party Risk Management: topics in the order to study them

  1. 1Third-Party Risk Fundamentals and Outsourcing DriversStart here to learn what counts as a third party, why firms outsource, and which risks come with it.
  2. 2Third-Party Risk Management LifecycleThe lifecycle is the backbone of the chapter, and every later topic fits into one of its stages.
  3. 3Governance, Roles and Regulatory ExpectationsOnce you know the stages, learn who owns each one and what supervisors expect.
  4. 4Risk Assessment, Metrics and Contract ControlsThis turns the lifecycle into practice: how you rate a provider, measure it and write protections into the contract.
  5. 5Concentration, Fourth-Party and Cloud RiskThese are the harder, firm-wide and system-wide risks, so they come after the basic controls.
  6. 6Operational Resilience and Third-Party Failure Case StudyFinish with the case study, which pulls every earlier idea together in one failure scenario.

How to prepare Case Study: Third-party Risk Management

This chapter rewards structured thinking more than memorisation. Build one framework and test it on cases.

  1. Read the fundamentals and write a one-page list of benefits of outsourcing (cost, skills, scale) against the risks it creates (operational, compliance, reputational, concentration).
  2. Learn the lifecycle stages in order and note the key question and control at each stage.
  3. Write down the accountability principle in your own words: a firm can outsource a task but not the responsibility for it.
  4. For each control, such as due diligence, service level agreements, audit rights, exit plans and monitoring, note which risk it reduces and at what stage.
  5. Practise reading short cases and label each one with the failed stage, the risk type and the control that was missing.
  6. For the failure case, trace the chain from provider outage to critical service disruption, then link it to impact tolerance, recovery and communication.
  7. In the last days, redo missed questions and say each answer aloud with its reason, so you can rule out options that shift responsibility to the vendor.

Common mistakes in Case Study: Third-party Risk Management

  • Choosing an answer that says the vendor is responsible for the failure.

    Fix: Remember that a firm stays accountable to customers and regulators. A contract can allow recovery of losses but does not transfer responsibility.

  • Mixing up the order of lifecycle stages.

    Fix: Think in sequence: decide, assess, contract, onboard, monitor, exit. Due diligence always precedes signing.

  • Treating all vendors the same.

    Fix: Use a risk-based approach. Critical providers get deeper due diligence, tighter contract terms and closer monitoring.

  • Confusing concentration risk with fourth-party risk.

    Fix: Concentration is reliance on one provider or a few. Fourth-party risk is reliance on the provider's subcontractors. A case can have both.

  • Assuming moving to the cloud removes security and resilience duties.

    Fix: Apply the shared responsibility idea. The provider secures its platform, while the firm manages its data, access and configuration.

  • Ignoring exit and contingency planning in case answers.

    Fix: When a case shows a failure or dependence, check for a tested exit plan, substitute provider or fallback process.

Last-day revision: Case Study: Third-party Risk Management

  • Outsourcing moves the activity, not the accountability.
  • The lifecycle runs from planning and due diligence to contracting, monitoring and exit.
  • Due diligence comes before the contract, and monitoring continues after it.
  • Criticality decides how deep the assessment and monitoring go.
  • The board sets risk appetite; management implements it; the first line owns the relationship day to day.
  • The risk function provides independent oversight and challenge.
  • Concentration risk arises when many services or many firms depend on the same provider.
  • A fourth party is a provider's own subcontractor, and the firm needs visibility of it.
  • Cloud use follows a shared responsibility model, so the firm still secures its own data and configuration.
  • Contracts should cover service levels, audit and access rights, incident notification, data protection and termination support.
  • An exit strategy and tested contingency plan reduce the damage of a provider failure.
  • Operational resilience asks whether critical services stay within impact tolerance during disruption.

Case Study: Third-party Risk Management practice questions

Case Study: Third-party Risk Management in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Case Study: Third-party Risk Management: frequently asked questions

Is this chapter calculation-heavy?

No. It is mostly conceptual and case-based. You need to apply frameworks, controls and definitions to a scenario and pick the best response.

Where does third-party risk sit in the FRM Part II syllabus?

It sits within the Operational Risk and Resilience topic, which is one of the six Part II topics. It also links to Current Issues, especially digital resilience.

What is the single most important idea to remember?

Accountability stays with the firm. Outsourcing can shift the work, but the firm must still oversee the provider and manage the risk.

How should I handle a case question on a provider failure?

Identify the critical service affected, find which lifecycle stage or control failed, and choose the answer that restores the service within tolerance while keeping oversight. Rule out options that only blame the vendor.