Skip to content

FRM Part II · FRM Exam Part II

Guidance on Managing Outsourcing Risk for FRM Part II

Outsourcing risk is the risk that a third party doing work for a firm fails, underperforms or exposes it to loss. Guidance on managing it covers board accountability, due diligence, contracts and service level agreements, monitoring, and exit and continuity planning. In the exam, match each scenario to the right control stage.

What this chapter covers

This chapter is about how a financial firm stays in control when someone else performs part of its work. Cloud hosting, payment processing, data services and call centres are common examples. The firm can hand over the activity. It cannot hand over the responsibility. That one idea runs through the whole chapter.

The guidance follows the life of an outsourcing arrangement. It starts with why firms outsource and what risks appear. It then moves to governance by the board and senior management, a risk management program with due diligence, the contract and service level agreements, ongoing monitoring, and finally continuity, exit and concentration. Learn it as a sequence and the details fall into place.

The chapter connects to the Operational Risk and Resilience topic in FRM Part II, where third-party failure, business continuity and operational resilience also appear. It also links to Current Issues, since digital resilience and cloud and AI providers raise concentration concerns. Liquidity and credit questions can touch it too, for example when a critical service provider fails during stress.

Part II has 80 multiple-choice questions in 4 hours, and many are applied and case-like. This chapter suits that style, because questions describe a firm's situation and ask which action, control or responsibility fits. The content is mostly conceptual, so careful reading earns marks without heavy calculation. It also reinforces operational resilience themes you need elsewhere in the paper, so the effort pays off twice.

Guidance on Managing Outsourcing Risk: topics in the order to study them

  1. 1Outsourcing Risk: Definition and DriversStart here to learn the vocabulary and why firms outsource, since every later control responds to these risks.
  2. 2Board and Senior Management ResponsibilitiesGovernance comes next because accountability stays with the firm and sets the tone for the whole program.
  3. 3Outsourcing Risk Management Program and Due DiligenceThis turns governance into a working process, covering how a provider is assessed before selection.
  4. 4Outsourcing Contracts and Service Level AgreementsThe contract captures the due diligence findings as enforceable terms, so it follows selection.
  5. 5Ongoing Monitoring, Reporting and OversightOnce the contract is signed, you study how performance and risk are tracked against it.
  6. 6Business Continuity, Exit Strategies and Concentration RiskFinish with failure scenarios and ending the relationship, which build on everything before.

How to prepare Guidance on Managing Outsourcing Risk

This is a concept chapter, so aim to understand the logic and be able to apply it to a short scenario. Do not try to memorise lists without context.

  1. Read the six topics once in study order and write one sentence for each stating its purpose in the life of an outsourcing arrangement.
  2. Fix the core principle: the firm remains accountable for outsourced activities, whoever performs them.
  3. For each stage, list the key controls and who owns them, such as the board, senior management, the risk function or the business line.
  4. Practise tying scenarios to stages. Ask whether the problem is a selection, contract, monitoring or exit issue, then pick the control that fits.
  5. Compare similar ideas side by side, such as due diligence versus ongoing monitoring, and business continuity versus exit strategy.
  6. Link the chapter to operational resilience and concentration themes in other Part II topics, and review it with timed multiple-choice practice.
  7. On the last day, reread your one-line summaries and the revision points below.

Common mistakes in Guidance on Managing Outsourcing Risk

  • Assuming risk moves to the provider along with the work.

    Fix: Remember that accountability stays with the firm. The provider carries the task, and the firm carries the risk and its regulatory duty.

  • Mixing up board duties and senior management duties.

    Fix: Link the board to policy, risk appetite and oversight, and senior management to implementation, resources and reporting upward.

  • Treating due diligence as a one-time step.

    Fix: Treat due diligence as the entry check and ongoing monitoring as the repeated check. Reassessment continues for as long as the arrangement does.

  • Choosing an answer about contract terms when the scenario is about monitoring.

    Fix: Ask first which stage of the lifecycle the scenario is in, then choose the control that belongs to that stage.

  • Confusing a business continuity plan with an exit strategy.

    Fix: Continuity keeps services running through a disruption. An exit strategy covers ending or transferring the arrangement in an orderly way.

  • Looking at concentration risk only at the single-firm level.

    Fix: Consider both the firm's dependence on one provider and wider dependence across the industry on a few providers, which can create systemic concern.

Last-day revision: Guidance on Managing Outsourcing Risk

  • Outsourcing risk is the risk of loss or disruption arising from a third party performing activities for the firm.
  • Responsibility cannot be outsourced. The firm stays accountable for the activity and its risks.
  • The board sets risk appetite and oversees the policy. Senior management implements it.
  • A risk management program covers the full life of the arrangement, not just selection.
  • Due diligence happens before the contract and looks at the provider's capability, financial strength, controls and resilience.
  • Contracts should define services, performance standards, audit and access rights, data protection, and termination terms.
  • Service level agreements set measurable performance standards that you can monitor.
  • Monitoring is continuous. It uses performance reports, issue escalation and periodic reassessment of the provider.
  • Critical or material outsourcing deserves stronger scrutiny than routine services.
  • Business continuity plans should cover provider failure and be tested.
  • An exit strategy lets the firm move the activity in-house or to another provider in an orderly way.
  • Concentration risk arises when many activities, or many firms, depend on one provider.

Guidance on Managing Outsourcing Risk practice questions

Guidance on Managing Outsourcing Risk in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Guidance on Managing Outsourcing Risk: frequently asked questions

Is Guidance on Managing Outsourcing Risk calculation-heavy?

No. It is mainly conceptual and tests judgement in applied scenarios. Expect questions asking which responsibility, control or action fits a described situation.

How does this chapter fit into FRM Part II?

It sits mainly with Operational Risk and Resilience, where third-party risk and continuity matter. It also connects to Current Issues topics such as digital resilience.

What is the single most important idea to remember?

The firm remains accountable for any activity it outsources. Most scenario questions test whether you apply this when assigning responsibility or choosing a control.

How long should I spend on this chapter?

Because it is conceptual, one focused pass plus a round of practice questions and a last-day review is usually enough. Spend extra time if you have little experience with third-party risk at work.