Skip to content

FRM Exam Part II · Case Study: Third-party Risk Management

Third-Party Risk Assessment, Metrics and Contract Controls

Updated 11 October 2026 · Fact-checked

Third-party risk assessment ranks each vendor by how critical its service is and how much risk it brings. You then track KRIs and SLAs to monitor performance, and write audit, security, and termination rights into the contract. Higher tiers get deeper due diligence, tighter metrics and stronger exit terms.

Understand Risk Assessment, Metrics and Contract Controls

Third-party risk is the chance that a vendor failure, breach or poor service harms your firm. You cannot remove it when you outsource. You keep accountability even if the vendor does the work. So you must assess, measure and control it.

Start with tiering. Not every vendor needs the same effort. You rate each one on criticality: how badly your business is hurt if the service stops, how fast, and how hard it is to replace. Other inputs are the sensitivity of data the vendor holds, system access, regulatory impact, customer impact, and concentration (many services with one vendor, or many firms relying on the same vendor). Typical output is tiers such as critical, high, medium and low. Tier sets the depth of due diligence, the review frequency and the contract terms.

Tiering usually looks at inherent risk (before controls). Then you assess the vendor's controls to get residual risk. A critical vendor with strong controls can still stay critical in tier, because tier reflects impact, not just control quality.

Next, measure. Key risk indicators (KRIs) are forward-looking signals of rising risk, for example vendor financial stress, rising incident counts, overdue audit findings, staff turnover at the vendor, or growing concentration. Key performance indicators (KPIs) and service level agreements (SLAs) measure delivery against agreed targets, such as uptime, response time, recovery time and error rates. A KRI needs a threshold and an escalation path, or it is just a number.

Finally, the contract turns oversight into enforceable rights. Key terms: defined scope and SLAs with remedies (service credits, penalties), right to audit and access for the firm and its regulator, security and data protection requirements, breach notification, business continuity and testing, subcontractor (fourth-party) approval, confidentiality, and termination rights with exit assistance and data return. Stronger terms go to higher tiers.

Key formulas to remember

Risk tier logic
Inherent risk = impact of failure × likelihood; Residual risk = inherent risk after vendor controls
Tier mainly follows criticality and impact. Good controls reduce residual risk but do not make a critical vendor non-critical.
Availability SLA
Availability (%) = (Total time − Downtime) ÷ Total time × 100
Check the measurement period and whether planned maintenance is excluded.
KRI threshold rule
Green: within appetite; Amber: early warning; Red: breach, escalate
Set thresholds before use and link each to a named owner and action.
Recovery objectives in SLAs
RTO = maximum tolerable time to restore; RPO = maximum tolerable data loss measured in time
Vendor RTO and RPO must fit the firm's own tolerances for the service.

How to solve Risk Assessment, Metrics and Contract Controls questions

Use this order for any scenario question on vendor assessment, metrics or contracts.

  1. 1Identify the service and ask how critical it is: impact of failure, time to impact, and substitutability.
  2. 2Check other tier drivers: data sensitivity, system access, regulatory exposure and concentration.
  3. 3Assign the tier and link it to depth of due diligence and monitoring frequency.
  4. 4Choose metrics: KRIs for early warning, SLAs and KPIs for delivery. Make sure each has a threshold and owner.
  5. 5Match contract controls to the risk: audit rights, security and breach notice, BCP testing, subcontracting limits, termination and exit support.
  6. 6Separate inherent from residual risk and say what remains after controls.
  7. 7Pick the answer that is risk-based and proportionate, and keeps accountability with the firm.

Quickest way: Tier, track, contract

When to use it: Use for multiple-choice questions with four plausible options and limited time.

  1. Ask: what is the most critical or sensitive feature in the stem? That decides the tier.
  2. Eliminate options that treat all vendors the same or that shift accountability to the vendor.
  3. Prefer options with forward-looking KRIs and defined thresholds over backward-looking loss counts.
  4. For contracts, prefer enforceable rights (audit, termination, exit) over vague best-efforts language.

Common mistakes in Risk Assessment, Metrics and Contract Controls

  • Tiering by contract value or spend only.

    Spend is easy to see and rank.

    Fix: Tier by criticality, data sensitivity, access and substitutability. A small-fee vendor can be critical.

  • Treating an SLA as a KRI.

    Both are numbers about the vendor.

    Fix: SLAs measure agreed delivery. KRIs signal rising risk, often before an SLA is breached.

  • Assuming strong vendor controls lower the tier.

    Confusing inherent and residual risk.

    Fix: Tier reflects impact if the service fails. Controls reduce residual risk, not criticality.

  • Believing outsourcing transfers accountability.

    The vendor performs the activity.

    Fix: The firm and its board remain responsible. Contracts provide rights, not a transfer of responsibility.

  • Relying on service credits as the main remedy.

    Credits look like protection.

    Fix: Credits are usually small compared with the loss. Add termination, exit assistance and audit rights.

  • Ignoring fourth parties.

    Focus stays on the direct vendor.

    Fix: Require disclosure and approval of subcontractors and flow down security and audit terms.

Worked examples

Example 1

A bank outsources its payment processing to Vendor A (annual fee $2 million) and its office plant-watering to Vendor B (annual fee $2 million). Vendor A holds customer account data and has no ready substitute. Which tier should each receive and why?

Show the solution
  1. Fees are equal, so spend does not separate them.
  2. Vendor A: failure stops payments, it holds sensitive data, and it is hard to replace. Impact is severe and fast.
  3. Vendor B: failure has negligible effect on operations or data, and replacement is easy.
  4. So A is critical tier with full due diligence, frequent monitoring and strong contract rights. B is low tier with light review.

Answer: Vendor A is critical tier; Vendor B is low tier. Tiering follows criticality, data sensitivity and substitutability, not fees.

Example 2

A cloud vendor's SLA promises 99.9% monthly availability. A 30-day month has 43,200 minutes. The vendor had 65 minutes of unplanned downtime. Did it meet the SLA, and what should the bank do about a KRI showing 3 consecutive months of rising downtime?

Show the solution
  1. Allowed downtime = 0.1% × 43,200 = 43.2 minutes.
  2. Actual downtime is 65 minutes, which exceeds 43.2.
  3. Availability = (43,200 − 65) ÷ 43,200 × 100 = 99.85%, below 99.9%.
  4. The SLA is breached, so remedies such as service credits apply.
  5. The rising trend is a KRI signal. Escalate per the threshold, request a root-cause review, and consider exercising audit rights and testing the exit plan.

Answer: The vendor missed the SLA (99.85% vs 99.9%). The bank should claim remedies and escalate the adverse KRI trend for review and possible audit.

Exam tips

  • Look for the word critical or hard to substitute in the stem. It points to the top tier and the strongest contract terms.
  • Questions often contrast KRI (leading) with SLA or KPI (agreed delivery). Match the definition carefully.
  • When asked about contract terms, pick audit and access rights for the firm and regulator, plus termination and exit support.
  • Do the availability arithmetic using total minutes in the period given, not a default 30 days.

Practice questions from Case Study: Third-party Risk Management

Risk Assessment, Metrics and Contract Controls: frequently asked questions

How do you tier vendors by criticality?

Rate each vendor on the impact if its service fails, how quickly impact occurs, data sensitivity, system access, regulatory exposure and how easily it can be replaced. Combine these into tiers such as critical, high, medium and low. The tier then sets due diligence depth and monitoring frequency.

What are good KRIs for third-party risk?

Examples are vendor financial deterioration, rising incident or breach counts, overdue audit findings, SLA breach trends, key staff turnover and concentration levels. Each needs a threshold, an owner and an escalation step.

What is the difference between an SLA and a KRI?

An SLA is a contractual target for service delivery, such as uptime or response time. A KRI is an early-warning indicator of rising risk. A KRI can move before any SLA is breached.

Which contract terms matter most for critical vendors?

Audit and access rights, security and breach notification terms, tested continuity and recovery commitments, control over subcontractors, and clear termination rights with exit assistance and data return.