FRM Exam Part II · Guidance on Managing Outsourcing Risk

Ongoing Monitoring, Reporting and Oversight of Outsourced Service Providers

Updated 11 October 2026 · Fact-checked

Ongoing monitoring is the continuous check that a service provider still delivers what the contract promises and that its risk stays within appetite. You use service-level metrics and KRIs, report exceptions to management and the board, have internal audit review the arrangement, and keep regulator access to the provider. Escalate when thresholds are breached.

Understand Ongoing Monitoring, Reporting and Oversight

Outsourcing does not transfer accountability. The bank can hand over a task, but it still owns the risk and the customer relationship. Due diligence and a good contract only describe the starting position. Providers change: they lose staff, change systems, take on new clients, or run into financial trouble. So the bank must keep watching after signing.

Monitoring starts with performance monitoring against the service level agreements (SLAs). Typical measures are uptime, processing accuracy, turnaround time, error rates and complaint volumes. Monitoring also covers the provider's financial health, its compliance with law, its security and its business continuity capability. The depth should match how critical the activity is. A critical or material service gets closer, more frequent review than a minor one.

Key risk indicators (KRIs) are forward-looking signals that risk is rising before a loss occurs. Examples are the number of SLA breaches, repeated system outages, staff turnover at the provider, a credit rating downgrade, overdue audit findings, security incidents and growing reliance on subcontractors. Each KRI needs a threshold, often set as amber and red levels, with a defined action when it is crossed. A KRI without a threshold and an owner is just a number.

Results must reach the right people. A relationship or contract owner reviews data regularly. Exceptions and trends go to senior management, and material issues go to the board or its risk committee. Reporting should be timely, consistent and show trends, not just a single snapshot.

Oversight adds independent challenge. Under the three lines of defense, the business owns the relationship, risk and compliance functions oversee it, and internal audit independently reviews whether the outsourcing framework and controls work. The contract should give the bank, its auditors and its regulator the right to access the provider's information, premises and records for the outsourced activity. Supervisors expect that outsourcing does not impair their ability to supervise the bank.

Key formulas to remember

Accountability rule: Outsourcing the activity ≠ outsourcing the responsibility; The board and senior management remain accountable for outsourced activities.
Proportionality rule: Monitoring intensity ∝ criticality (materiality) of the service; Critical services get more frequent, deeper monitoring and reporting.
KRI escalation logic: KRI value vs threshold: green (within appetite) → amber (early warning) → red (breach, escalate and act); Each threshold needs an owner and a predefined action.
SLA attainment: SLA attainment (%) = (measured performance ÷ target) × 100, or the share of periods meeting target; Use the SLA's own definition. For error measures, lower is better, so compare the actual to the maximum allowed.
Three lines of oversight: 1st line: business owner; 2nd line: risk and compliance; 3rd line: internal audit; Internal audit gives independent assurance and does not run day-to-day monitoring.

How to solve Ongoing Monitoring, Reporting and Oversight questions

Use this sequence for scenario questions about monitoring a service provider.

1Identify the outsourced activity and judge how critical it is. This sets the depth of monitoring.
2Find what is being measured: SLA performance, KRIs, financial health, compliance, security or continuity.
3Compare the data with thresholds or SLA targets. Decide if it is within appetite, an early warning or a breach.
4Decide who must be told: contract owner, senior management, risk committee or board. Match the level to the severity.
5Identify the right action: more monitoring, remediation plan, penalties, enhanced audit, or invoking the exit plan if the breach is serious or repeated.
6Check the independent layer: internal audit review and regulator access rights in the contract.
7Pick the option that keeps accountability with the bank and uses forward-looking indicators.

Quickest way: Who, what, when: a 3-question filter

When to use it: Use for multiple-choice questions where several options sound reasonable.

Who is accountable? If an option says the provider takes over responsibility, reject it.
Is the measure forward-looking? A KRI warns early. A loss report is lagging.
Does the action match severity and independence? Routine issues go to management. Material or repeated breaches go to the board. Independent assurance comes from internal audit, not the business owner.

Common mistakes in Ongoing Monitoring, Reporting and Oversight

Believing the provider takes on the risk once the contract is signed.
Outsourcing sounds like a transfer of risk.
Fix: Remember that accountability stays with the bank's board and senior management. Only the task is delegated.
Treating monitoring as a one-time check at onboarding.
Due diligence is confused with ongoing oversight.
Fix: Due diligence is before signing. Monitoring is continuous and runs through the contract life.
Confusing KRIs with loss data.
Both appear in operational risk reports.
Fix: KRIs are leading indicators of rising risk. Loss events are lagging. Prefer KRIs for early warning.
Setting KRIs without thresholds, owners or actions.
Candidates focus on picking metrics, not on using them.
Fix: A usable KRI has amber and red thresholds, a named owner and an escalation path.
Applying the same monitoring to every vendor.
Candidates assume consistency means uniformity.
Fix: Use a risk-based approach. Critical services get more frequent and deeper review.
Giving internal audit the job of day-to-day monitoring.
Audit and oversight are blurred.
Fix: The business and risk functions monitor. Internal audit independently reviews the framework and controls.

Worked examples

Example 1

A bank outsources its payment processing to a vendor. The SLA requires 99.9% uptime per month. Over three months the vendor delivers 99.95%, 99.80% and 99.70%. The amber trigger is below 99.9% and the red trigger is two consecutive months below 99.9%. What is the status and the right response?

Show the solution

Compare each month with the 99.9% target: month 1 meets it, month 2 misses it, month 3 misses it.
Months 2 and 3 are consecutive misses, so the red trigger is met.
The trend is also worsening (99.95% → 99.80% → 99.70%), which is a warning sign for deeper problems.
Because payment processing is critical, escalate to senior management and the risk committee, require a remediation plan from the vendor, apply SLA remedies, and increase monitoring. Review whether exit or contingency arrangements are ready.

Answer: Status is red. Escalate beyond the contract owner, demand a remediation plan, enforce SLA remedies and prepare contingency or exit options.

Example 2

A risk manager is asked which one of four items is the best forward-looking KRI for a critical cloud provider: (A) last year's operational loss from the provider, (B) the number of provider security incidents per month trending upward, (C) the contract signing date, (D) the bank's total revenue. Which is best and why?

Show the solution

A KRI should signal rising risk before losses occur and be tied to the provider.
Option A is a past loss, so it is lagging.
Option C is a fixed fact and does not change with risk.
Option D is unrelated to provider risk.
Option B is measurable, specific to the provider, and an upward trend warns of weaker security before a major loss.

Answer: Option B. A rising count of provider security incidents is a leading indicator that can be given thresholds and escalation actions.

Exam tips

Look for the words continuous, ongoing and periodic. The correct answer usually shows monitoring that continues after onboarding.
If a question asks who is accountable, the answer is the bank's board and senior management, not the provider.
Match the escalation level to severity. Do not send every minor SLA miss to the board.
For independence questions, choose internal audit. For regulator questions, choose contractual access rights for the bank, its auditors and supervisors.
Prefer answers that use thresholds, trends and defined actions over vague statements like keep an eye on the vendor.

Practice questions from Guidance on Managing Outsourcing Risk

Ongoing Monitoring, Reporting and Oversight: frequently asked questions

What are good KRIs for outsourcing risk?

Common examples are SLA breaches, repeated outages, error rates, security incidents, provider staff turnover, financial downgrades, overdue audit findings and reliance on subcontractors. Each needs a threshold, an owner and an action. Choose indicators that warn early.

How often should a bank monitor a third-party provider?

It depends on how critical the service is. Critical services need frequent, often continuous, monitoring and regular formal reviews. Lower-risk services can be reviewed less often. Exam answers should show a risk-based approach.

What is the role of internal audit in outsourcing oversight?

Internal audit gives independent assurance that the outsourcing framework, controls and monitoring work as intended. It reviews the arrangement and reports findings to senior management and the board. It does not replace day-to-day monitoring by the business and risk functions.

Why must regulators have access to outsourced activities?

Supervisors need to assess the bank's risks even when work is done by a provider. Contracts should therefore allow the bank, its auditors and the regulator to access relevant information and records. Outsourcing should not weaken supervision.