FRM Exam Part II · Guidance on Managing Outsourcing Risk

Outsourcing Contracts and Service Level Agreements for FRM Part II

Updated 11 October 2026 · Fact-checked

An outsourcing contract is the legal document that turns a bank's risk expectations into enforceable duties for a service provider. A service level agreement (SLA) sets measurable performance targets. To answer exam questions, match each risk to the clause that controls it: audit rights, subcontracting limits, data protection, termination and confidentiality.

Understand Outsourcing Contracts and Service Level Agreements

When a bank outsources an activity, it hands over the work but keeps the responsibility. Regulators expect the board and senior management to stay accountable for the outsourced activity as if the bank did it itself. The contract is the main tool that makes this possible. If a duty is not in the contract, the bank cannot easily enforce it.

A service level agreement (SLA) is the part of the contract that defines the service in measurable terms. It states what the provider must deliver, how performance is measured, how often it is reported, and what happens if targets are missed. Good SLAs use clear metrics such as availability, processing time, error rates and incident response times. They also set remedies, such as service credits, escalation or the right to terminate.

Beyond service levels, sound contracts cover a set of standard provisions. These include the scope of services, audit and access rights for the bank, its auditors and its supervisors, limits and approval rights over subcontracting, data protection and security duties, confidentiality, business continuity and disaster recovery obligations, incident notification, liability and indemnity, and termination and exit rights with transition support.

Think of each clause as a control for a specific risk. Audit and access rights control the risk of poor visibility. Subcontracting clauses control hidden fourth-party risk. Data clauses control privacy and security breaches. Termination and exit clauses control the risk of being locked in or left without service. Exam questions usually describe a failure and ask which clause was missing or weak.

Regulators also expect the contract not to block supervision. The provider should allow the supervisor access to information and premises relevant to the outsourced activity. A clause that lets the provider refuse access, or one that makes the bank pay heavily to leave, is a red flag.

Key formulas to remember

Accountability rule: Outsourcing the activity ≠ outsourcing the responsibility; The bank's board and senior management remain accountable for outsourced activities.
Clause-to-risk mapping: Service levels → performance risk; audit/access → oversight risk; subcontracting → fourth-party risk; data protection/confidentiality → information risk; termination/exit → lock-in and continuity risk; Use this to match a described failure to the missing clause.
SLA components: SLA = metric + target + measurement method + reporting frequency + remedy; A target with no measurement or remedy is weak.

How to solve Outsourcing Contracts and Service Level Agreements questions

Use this method for any question on outsourcing contract provisions.

1Identify the failure or risk in the scenario: poor performance, data leak, hidden subcontractor, supervisor blocked, or trapped in the contract.
2Decide which clause should have controlled it.
3Check who bears accountability. The bank always does, regardless of what the contract says.
4Test the clause quality: is it measurable, enforceable and covering the bank, its auditors and the supervisor?
5Look for linked provisions, such as subcontracting approval plus flow-down of the same obligations.
6Eliminate options that weaken the bank's control, such as provider-only audit or unrestricted subcontracting.
7Choose the answer that gives the bank enforceable rights and keeps supervisory access intact.

Quickest way: Match the failure to the clause

When to use it: Use when the question describes an incident and asks which provision was missing or most important.

Underline the failure word: breach, outage, subcontractor, audit refused, exit.
Map it: breach → data protection; outage → SLA and continuity; subcontractor → subcontracting approval; refused access → audit rights; exit trouble → termination and transition.
Pick the option that gives the bank an enforceable right, not a promise of best efforts.

Common mistakes in Outsourcing Contracts and Service Level Agreements

Thinking outsourcing transfers accountability to the provider.
The work is done by someone else, so responsibility seems to move too.
Fix: Remember that the board and senior management stay accountable. The contract only supports control.
Treating an SLA as a general promise of good service.
The word agreement sounds broad.
Fix: An SLA is measurable: metric, target, reporting and remedy. Vague wording is a weakness.
Giving audit rights only to the bank.
Students forget the supervisor.
Fix: Rights should extend to the bank's internal and external auditors and to regulators.
Allowing subcontracting freely if the provider stays liable.
Provider liability looks like enough protection.
Fix: The bank needs notice or approval rights and flow-down of security, audit and confidentiality duties to subcontractors.
Ignoring exit terms until the end of the relationship.
Exit seems unlikely at signing.
Fix: Negotiate termination triggers, transition assistance and data return or deletion up front.

Worked examples

Example 1

A bank's card-processing provider quietly moves data handling to a firm in another country. The bank learns of this only after a data breach. Which contract provision was most clearly missing or weak?
A. A higher service credit for downtime
B. Subcontracting controls with approval or notice rights and flow-down of data protection duties
C. A longer contract term
D. A lower fee schedule

Show the solution

Identify the failure: an unapproved subcontractor handled data and a breach followed.
Map the failure: hidden fourth-party risk and data protection risk.
Option A addresses availability, not data handling.
Options C and D are commercial terms and do not control the risk.
Option B gives the bank visibility and ensures the subcontractor is bound by the same duties.

Answer: B

Example 2

A bank's outsourcing contract says the provider will give the bank a summary report each year but refuses on-site access to the bank's supervisor, citing confidentiality of other clients. What is the best assessment?

Show the solution

Identify the issue: access for oversight is restricted.
Recall the expectation: audit and access rights should cover the bank, its auditors and the supervisor, for the outsourced activity.
Confidentiality of other clients can be handled by limiting access to what is relevant to the bank, not by refusing access.
A summary report supplied by the provider is not independent assurance.
The bank should renegotiate to include access and audit rights, or reconsider the arrangement.

Answer: The contract is deficient. Confidentiality does not justify blocking supervisory access. The bank should secure audit and access rights for itself, its auditors and its supervisor, scoped to the relevant activity.

Exam tips

Expect scenario questions where you must name the missing clause. Map the failure first, then pick.
Reject answers that move accountability to the provider.
Prefer measurable and enforceable wording over best-efforts language.
Check that audit rights include regulators and that subcontractors inherit the obligations.
When two clauses seem right, choose the one that directly controls the described failure.

Practice questions from Guidance on Managing Outsourcing Risk

Outsourcing Contracts and Service Level Agreements: frequently asked questions

What is a service level agreement in outsourcing?

It is the part of an outsourcing contract that defines performance in measurable terms. It sets metrics, targets, reporting and remedies if targets are missed. Examples include availability and incident response times.

What are the key clauses in a bank outsourcing contract?

Typical clauses cover scope and service levels, audit and access rights, subcontracting, data protection and security, confidentiality, business continuity, incident notification, liability, and termination and exit support.

Why do regulators want audit rights in outsourcing agreements?

Supervisors need to see how an outsourced activity is run, since the bank stays accountable for it. Audit and access rights let the bank, its auditors and the regulator verify controls and performance.

Can a bank transfer responsibility to the provider through the contract?

No. The contract can allocate liability and duties, but the board and senior management remain accountable for outsourced activities.