FRM Exam Part II · Guidance on Managing Outsourcing Risk

Business Continuity, Exit Strategies and Concentration Risk in Outsourcing

Updated 11 October 2026 · Fact-checked

When a bank outsources a service, it keeps the risk. You manage it with a tested business continuity plan, a documented exit or termination plan, visibility of subcontractors, and limits on dependence on one provider. Concentration risk arises when many functions, or many banks, rely on the same critical provider.

Understand Business Continuity, Exit Strategies and Concentration Risk

Outsourcing moves the work to a provider. It does not move the accountability. The board and senior management of the bank remain responsible for the outsourced service, as if it were done in-house. So you need a plan for the day the provider fails, or the day you want to leave.

Business continuity planning (BCP) covers how the service keeps running during a disruption at the provider. Good practice is that the bank understands the provider's own continuity plans, checks that they match the bank's recovery time objectives, and tests them. Testing can mean joint exercises, review of the provider's test results, and scenarios such as loss of a site, a cyber attack or a provider insolvency. A plan that has never been tested is weak evidence of resilience.

Exit and termination plans cover how you leave. There are two broad types. A stressed exit is forced by provider failure, regulatory action or a serious breach, so time is short. A planned exit is a choice, for example at contract end or on a cost or performance issue. For each, the plan sets out the alternatives: move to another provider, or bring the service back in-house (insourcing). It also covers data return, transition assistance, and termination rights in the contract. Moving to another provider needs a market that has capable alternatives. Insourcing needs people, systems and capacity that the bank may have lost since outsourcing, so it can take longer than expected.

Subcontracting chains (fourth parties) add hidden dependencies. Your provider may rely on another firm, possibly in another country. The bank should know which subcontractors support critical services, have contract rights over material subcontracting, and see that the provider manages them. Offshoring adds country risk: legal and political change, data location rules, supervisor access and time-zone issues.

Concentration risk has two forms. At firm level, too many critical services depend on one provider or one location. At sector level, many banks depend on the same few providers, such as cloud platforms. A failure then hits many institutions at once. A single bank cannot remove sector concentration, but it can map dependencies, set tolerances, use multiple regions or providers where practical, and plan for failure.

Key formulas to remember

Recovery time objective (RTO) test: Provider's demonstrated recovery time ≤ bank's RTO for the critical service; If the provider's tested recovery is longer than your RTO, there is a gap to fix or accept formally.
Accountability rule: Outsourced activity ⇒ risk and accountability stay with the bank; You can outsource tasks, not responsibility.
Concentration share (simple indicator): Provider share = value of critical services (or exposure) on one provider ÷ total value of critical services; A high share signals concentration. There is no universal limit; the bank sets tolerances.
Exit plan scope: Exit plan = stressed exit + planned exit, each with transition route (new provider or insourcing), data return and timeline; Check that both exit types are covered.

How to solve Business Continuity, Exit Strategies and Concentration Risk questions

Use this order for any scenario question on continuity, exit or concentration.

1Identify the service and whether it is critical to the bank's important business services.
2Name the risk type: provider failure, subcontractor failure, offshoring or country risk, or concentration.
3Check who is accountable. It is the bank's board and senior management.
4Match the control to the risk: tested BCP for disruption, exit plan for leaving, subcontractor visibility for chains, diversification or tolerance limits for concentration.
5Decide stressed or planned exit, and the route: alternative provider or insourcing.
6Check feasibility: alternatives exist, data can be returned, staff and systems can be rebuilt, timing fits the RTO.
7Pick the answer that is tested, documented and proportionate, not one that only exists on paper or ignores the dependency.

Quickest way: Control-to-risk matching

When to use it: For multiple-choice questions asking for the best action or the main weakness.

Underline the trigger word: failure, exit, subcontractor, offshore, or many banks.
Map it: failure to BCP test; exit to exit plan; subcontractor to fourth-party visibility; many banks to sector concentration.
Eliminate options that transfer accountability to the provider or rely on untested plans.
Prefer the option that is specific, tested and covers a stressed scenario.

Common mistakes in Business Continuity, Exit Strategies and Concentration Risk

Saying outsourcing transfers risk to the provider.
The contract assigns tasks and penalties, so it feels like risk moves.
Fix: Remember that accountability stays with the bank. The contract only gives you remedies.
Treating an exit plan as only a termination clause.
Legal rights are easy to see, while operational transition is not.
Fix: A real exit plan also covers data return, transition support, alternative provider or insourcing, and timing.
Assuming insourcing is always the safe fallback.
It sounds like full control.
Fix: Check whether the bank still has staff, systems and capacity. Rebuilding can be slow and costly.
Ignoring subcontractors because the contract is with the main provider.
The bank has no direct relationship with fourth parties.
Fix: Require disclosure of material subcontractors, flow-down of obligations and notice of changes.
Thinking diversification at one bank removes sector concentration.
Firm level and system level are blurred.
Fix: Separate the two. A bank can reduce its own dependence, but many banks on one provider remains a systemic issue.
Relying on the provider's BCP document without testing.
A written plan looks like assurance.
Fix: Ask for test evidence, join exercises and compare recovery times with your RTO.

Worked examples

Example 1

A bank outsources its payments processing to one provider. The provider's tested recovery time is 8 hours. The bank's RTO for payments is 4 hours. Which is the best response? (A) Accept, since the provider is accountable. (B) Close the gap by improving provider resilience or adding a fallback, and record any residual risk. (C) Cancel testing to avoid findings. (D) Rely on the contract penalty.

Show the solution

Compare 8 hours to the 4-hour RTO. The provider is 4 hours too slow.
Accountability stays with the bank, so (A) is wrong.
Skipping testing hides the problem, so (C) is wrong.
A penalty compensates after loss but does not restore service, so (D) is wrong.
(B) closes or formally manages the gap.

Answer: (B)

Example 2

A bank has ₹800 crore of critical-service annual spend. ₹520 crore is with one cloud provider. (a) Compute the provider share. (b) Which exit consideration matters most?

Show the solution

Share = 520 ÷ 800 = 0.65, or 65%.
Such a high share signals concentration at firm level.
For exit, the key issue is whether a stressed exit is feasible: alternative provider capacity, data portability and time to migrate.
The bank should document the route, test parts of it and consider multi-region or secondary-provider arrangements.

Answer: (a) 65%. (b) Feasibility of a stressed exit: portability of data and workloads and available alternatives within the RTO.

Exam tips

If an option says responsibility moves to the provider, it is almost certainly wrong.
Look for the word 'tested'. The best answer usually includes testing, not just documentation.
Separate stressed exit from planned exit; questions often hinge on that.
For concentration, check whether the question is about one bank or the whole sector.
Fourth-party questions are about visibility and contract flow-down, not about replacing the main provider.

Practice questions from Guidance on Managing Outsourcing Risk

Business Continuity, Exit Strategies and Concentration Risk: frequently asked questions

What should an outsourcing exit plan contain?

It should cover both stressed and planned exits. It should set out the route (another provider or insourcing), data return, transition support, timelines and termination rights. It should also be tested or at least reviewed for feasibility.

What is concentration risk with cloud providers?

It is the risk that many critical services at a bank, or at many banks, depend on the same few providers. One outage or failure then causes widespread disruption. A bank can reduce its own exposure, but sector concentration remains.

How is outsourcing exit different from insourcing exit planning?

For outsourcing, the exit plan covers leaving a provider and moving to another or bringing the work back in-house. Bringing it back needs rebuilt people and systems. Moving to another provider needs available alternatives and data portability.

Does the bank need to test the provider's business continuity plan?

Yes, in proportion to the criticality of the service. The bank should review the provider's plans and test results and ideally take part in joint exercises. It should compare tested recovery times with its own RTO.