FRM Exam Part II · Guidance on Managing Outsourcing Risk

Board and Senior Management Responsibilities in Outsourcing Risk

Updated 11 October 2026 · Fact-checked

The board is ultimately accountable for outsourcing. It sets risk appetite and approves the outsourcing policy. Senior management implements them, oversees providers and reports back. Outsourcing transfers the activity, never the responsibility: the bank stays accountable to customers and regulators for outsourced services as if it performed them itself.

Understand Board and Senior Management Responsibilities

Outsourcing means a bank uses a third party to perform an activity it could otherwise do itself. Banks do this for cost, skills, scale and speed. The risk is that the service now sits outside the bank's direct control, but the bank's customers, regulators and shareholders still look to the bank when something fails.

This leads to the central principle: outsourcing does not transfer accountability. You can hand over the task. You cannot hand over the responsibility for it. If a provider loses customer data or fails to process payments, the bank answers for it. Expect the exam to test this directly, often through a tempting wrong option such as 'the contract shifts liability to the provider'.

The board has the oversight role. It sets or approves the bank's outsourcing risk appetite, approves the outsourcing policy, and makes sure the framework fits the bank's strategy. It also expects regular, meaningful reporting and challenges what it sees. The board does not run the contracts day to day.

Senior management has the execution role. It turns board policy into procedures, assigns clear roles, makes sure there is enough skilled staff and budget, and ensures risk assessment, due diligence, contracts and monitoring are done. It escalates material issues to the board. Critical or material outsourcing needs closer attention and higher approval levels than routine services.

A useful way to remember it: the board decides how much outsourcing risk the bank will accept and holds management to it. Management decides how to live within that limit. Both stay accountable. The independent risk and audit functions give assurance that the framework works.

Key formulas to remember

Accountability principle: Outsourced activity ≠ outsourced responsibility; The bank remains fully accountable to customers and regulators for outsourced services.
Board role: Board = set risk appetite + approve policy + oversee + challenge; Oversight and approval, not day-to-day management of providers.
Management role: Management = implement + assess + monitor + report + escalate; Executes within the board's appetite and informs the board of material issues.
Proportionality: Depth of controls ∝ materiality and criticality of the outsourced activity; Critical activities need stronger due diligence, monitoring, approval and exit planning.

How to solve Board and Senior Management Responsibilities questions

Use this sequence for any question on who is responsible for what in outsourcing.

1Identify who the question is about: the board, senior management, the service provider or an independent function.
2Check whether the question tests accountability. If so, the bank (and ultimately its board) remains accountable despite outsourcing.
3Separate oversight from execution. Appetite, policy approval and challenge sit with the board. Implementation, monitoring and reporting sit with management.
4Check materiality. For critical or material activities, expect higher approval levels, stronger due diligence and exit plans.
5Test each option against the principle: any option saying responsibility, liability to customers or regulatory duty moves to the provider is wrong.
6Choose the option that keeps accountability with the bank and shows a clear, documented governance chain.

Quickest way: Three-question filter

When to use it: Use when you have under a minute and the options look similar.

Does an option say accountability moves to the provider? Eliminate it.
Is the task about setting appetite or approving policy? Pick the board. Is it about running, monitoring or reporting? Pick senior management.
Between two good options, pick the one tied to materiality or a documented framework.

Common mistakes in Board and Senior Management Responsibilities

Believing a strong contract transfers responsibility to the provider.
Contracts can allocate financial liability, so students assume they also allocate accountability.
Fix: Remember that regulatory and customer accountability stays with the bank. A contract only supports recovery and control.
Giving the board day-to-day control of provider monitoring.
Students read 'ultimately responsible' as 'does the work'.
Fix: The board oversees and challenges. Management monitors and reports.
Treating outsourcing policy as a management-only document.
Policies feel operational.
Fix: The board approves the policy and the risk appetite behind it. Management maintains procedures under it.
Applying the same controls to every outsourced service.
Students forget proportionality.
Fix: Scale due diligence, approval level, monitoring and exit planning to how critical the activity is.
Ignoring risk appetite and focusing only on cost savings.
Outsourcing is usually presented as a cost decision.
Fix: The decision must fit the board-approved appetite, including concentration, resilience and data risks.
Thinking oversight ends once the contract is signed.
Students treat onboarding as the main control.
Fix: Responsibilities continue through monitoring, reporting, review and exit.

Worked examples

Example 1

A bank outsources its card processing to a provider. The provider suffers an outage and customers cannot make payments for a day. The contract says the provider bears all liability. Which statement is most accurate? (A) The bank is no longer accountable because liability sits with the provider. (B) The bank remains accountable to customers and regulators. (C) Only the provider is answerable to the regulator. (D) Accountability passes to the provider after due diligence is completed.

Show the solution

Identify the principle tested: outsourcing and accountability.
The contract may allocate financial loss between the parties, but it cannot remove the bank's duties to customers and regulators.
Option A confuses contractual liability with accountability. Option C is wrong because the regulator supervises the bank. Option D is wrong because due diligence never transfers accountability.
Option B states the principle correctly.

Answer: (B) The bank remains accountable to customers and regulators.

Example 2

Which allocation of responsibilities is most consistent with sound outsourcing governance? (A) Board negotiates each contract and monitors provider performance daily. (B) Board approves the outsourcing policy and risk appetite; senior management implements, monitors and reports material issues. (C) Senior management sets risk appetite; the provider approves policy. (D) Internal audit owns outsourcing risk and performs all monitoring.

Show the solution

Separate oversight from execution.
Option A pushes day-to-day work onto the board, which is not its role.
Option C gives policy approval to the provider, which would give away control.
Option D makes the independent assurance function the risk owner, which breaks independence.
Option B matches the board's approval and oversight role and management's execution and reporting role.

Answer: (B) The board approves policy and risk appetite; management implements, monitors and reports.

Exam tips

Scan options first for 'transfers responsibility' or 'liability moves to the provider'. These are almost always traps.
Use verbs: board sets, approves, oversees, challenges; management implements, monitors, reports, escalates.
Link depth of control to materiality. Critical activities get the most scrutiny.
In case questions, ask whether the failure was a governance gap, such as no appetite, no policy or no reporting, before looking at technical causes.
Remember that independent risk and audit functions provide assurance and do not own the outsourcing decision.

Practice questions from Guidance on Managing Outsourcing Risk

Board and Senior Management Responsibilities in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

ACCA Applied SkillsInternal Control and Risk Management Responsibilities

Board and Senior Management Responsibilities: frequently asked questions

Can a bank outsource accountability to a service provider?

No. A bank can outsource an activity but not its responsibility for it. The board and senior management remain accountable to customers and regulators for outsourced services.

What does the board do on outsourcing risk?

It sets or approves risk appetite and the outsourcing policy, oversees the framework and challenges management. It expects regular reporting, especially on material or critical arrangements.

What is the role of senior management in outsourcing?

Senior management implements the board's policy. It assigns roles, ensures risk assessment, due diligence, contracts and monitoring are done, and escalates significant issues to the board.

How does risk appetite link to outsourcing decisions?

Risk appetite states how much outsourcing risk the bank will accept, including concerns such as resilience, data and concentration. Each outsourcing decision should fit within it.