FRM Exam Part II · Guidance on Managing Outsourcing Risk

Outsourcing Risk: Definition and Drivers in Banking

Updated 11 October 2026 · Fact-checked

Outsourcing risk is the chance of loss, disruption or regulatory breach when a bank hands an activity to an outside provider. Banks outsource for cost, expertise, scale and speed. The main risks are operational, compliance, reputational, concentration and strategic. The bank stays accountable even when the provider performs the work.

Understand Outsourcing Risk: Definition and Drivers

Outsourcing means a bank uses an outside provider to perform an activity that the bank could otherwise do itself, either now or in the past. Examples are running data centres, processing payments, operating call centres or hosting cloud systems. The provider may be an unrelated firm or another entity in the same group.

Third-party arrangements are the wider category. They include outsourcing, but also other dependencies such as vendors of software, data feeds, utilities, consultants, and correspondent or clearing relationships. A simple way to remember it: all outsourcing is a third-party arrangement, but not every third-party arrangement is outsourcing. Do not assume that GARP's reading draws this line in exactly one way. Read the question's wording and use the definition it gives.

Banks outsource for clear reasons. They want lower or more variable costs, access to specialist skills or technology, economies of scale, faster launch of products, and the ability to focus on core business. Outsourcing can also improve resilience if the provider is stronger than the bank. But these drivers also create the risks, because the bank gives up direct control over people, systems and data.

The key principle is that accountability cannot be outsourced. The board and senior management remain responsible for the activity, its risks and its compliance with law, even if a provider performs it. Supervisors expect the bank to manage an outsourced activity as carefully as one done in-house.

The main risk types are these. Operational risk: the provider's failure, error, outage or cyber incident stops or damages the service. Compliance risk: the provider breaches law or regulation, for example on data protection, AML or consumer rules, and the bank is held responsible. Reputational risk: poor provider service or conduct harms customers and the bank's name. Concentration risk: many services depend on one provider, or the whole industry depends on a few providers, so one failure spreads widely. Strategic risk: the outsourcing decision conflicts with the bank's goals, or leaves the bank unable to bring the activity back or switch provider. Other risks include legal, country, data and exit risk.

Key formulas to remember

Accountability rule: Outsourcing the activity ≠ outsourcing the responsibility; The bank's board and senior management stay accountable for outsourced activities.
Scope relationship: Outsourcing ⊂ Third-party arrangements; Outsourcing is one type of third-party arrangement. Check the definition used in the question.
Main outsourcing risks: Operational, compliance, reputational, concentration, strategic; Learn these five and be able to match each to a scenario.
Drivers of outsourcing: Cost, expertise, scale, speed, focus on core business; Drivers explain why banks outsource. They are not risks themselves.

How to solve Outsourcing Risk: Definition and Drivers questions

Use this method for any scenario question on outsourcing risk definition, drivers or risk types.

1Identify the activity and who performs it. Is a provider doing something the bank relies on?
2Decide whether it is outsourcing or a wider third-party arrangement, using the definition in the question.
3Ask what is the bank's aim: cost, expertise, scale, speed or focus. This is the driver.
4Find the failure or event described: outage, breach, misconduct, single-provider dependence, or loss of flexibility.
5Map the event to the risk type: operational, compliance, reputational, concentration or strategic.
6Check who is accountable. The answer is the bank's board and senior management.
7Eliminate options that say risk is transferred to the provider or that remove bank responsibility.
8Pick the option that matches both the cause and the main consequence.

Quickest way: Event-to-risk matching

When to use it: Use when a short scenario names an event and asks which risk it mainly represents.

Outage, error or system failure at the provider: operational risk.
Provider breaks a law or rule and the bank is liable: compliance risk.
Customers blame the bank's name: reputational risk.
Many services or many banks rely on one provider: concentration risk.
Cannot switch provider or the deal clashes with business goals: strategic risk.
If the option says responsibility moves to the provider, reject it.

Common mistakes in Outsourcing Risk: Definition and Drivers

Believing outsourcing transfers risk and accountability to the provider.
A contract shifts the work and may give compensation, so it feels like the risk has gone.
Fix: Remember that the bank remains accountable to customers and supervisors. A contract can share financial loss at best.
Treating outsourcing and third-party risk as identical.
The terms are often used loosely in practice.
Fix: Treat outsourcing as a subset of third-party arrangements, and follow the definition given in the question.
Confusing concentration risk with operational risk.
Both involve a provider failing.
Fix: Choose concentration when the stem stresses dependence on one provider or a few providers. Choose operational when it stresses the failure itself.
Listing drivers as risks.
Cost savings and speed are mixed up with the downsides they create.
Fix: Separate why banks outsource (drivers) from what can go wrong (risks).
Assuming outsourcing is only for non-core, low-value tasks.
Textbook examples often show call centres or IT support.
Fix: Banks can outsource critical functions too. The more critical the activity, the stronger the oversight expected.
Ignoring strategic risk.
Students focus on outages and compliance, which feel more concrete.
Fix: Include loss of skills, lock-in and difficulty bringing work back in-house as strategic risk.

Worked examples

Example 1

A bank moves its customer payment processing to a single cloud provider. A regional outage at the provider stops payments for a full day, and customers complain publicly. Which risks are most directly shown, and who is accountable?

Show the solution

The activity is payment processing, performed by an outside provider, so this is outsourcing.
The outage stopping a service is operational risk.
Reliance on one provider for a critical service points to concentration risk.
Public complaints damaging the bank's image are reputational risk.
Accountability stays with the bank's board and senior management, not the provider.

Answer: Operational risk (the outage), concentration risk (single provider) and reputational risk (public complaints). The bank remains accountable.

Example 2

Which of the following is the most accurate statement about outsourcing in banking? A) Outsourcing transfers regulatory accountability to the provider. B) Banks outsource mainly to increase their control over operations. C) Outsourcing is a type of third-party arrangement, and the bank remains accountable for the outsourced activity. D) Outsourcing removes operational risk from the bank.

Show the solution

Option A is wrong because accountability stays with the bank.
Option B is wrong because outsourcing usually reduces direct control. Drivers are cost, expertise, scale and speed.
Option D is wrong because operational risk is changed, not removed. New provider risks appear.
Option C states both the scope relationship and the accountability principle.

Answer: C

Exam tips

Expect scenario questions that ask you to match an event to a risk type. Practise the event-to-risk list until it is automatic.
Reject any option that says risk or accountability moves to the provider.
Read for words such as single provider, sector-wide dependence or exit difficulty. They signal concentration or strategic risk.
Separate drivers from risks. A question on why banks outsource wants cost, expertise, scale or speed, not risks.
Use the definition in the question stem for outsourcing versus third-party scope before choosing.

Practice questions from Guidance on Managing Outsourcing Risk

Outsourcing Risk: Definition and Drivers: frequently asked questions

What is outsourcing risk in banking?

It is the risk of loss, disruption or regulatory breach arising because a bank relies on an outside provider to perform an activity. It covers operational, compliance, reputational, concentration and strategic risks. The bank stays accountable for the activity.

What is the difference between outsourcing and third-party risk?

Outsourcing is when a provider performs an activity the bank could do itself. Third-party risk is wider and includes any external dependency, such as software vendors, data suppliers and other service relationships. Outsourcing is a subset of third-party arrangements.

Why do banks outsource?

Common drivers are lower or more flexible costs, access to specialist skills and technology, economies of scale, faster product launches and focus on core business. These benefits come with loss of direct control, which creates the risks.

Can a bank transfer outsourcing risk to the provider by contract?

No. A contract can set service levels and allocate some financial loss, but the bank remains accountable to customers and supervisors. Exam answers that claim full transfer of responsibility are wrong.