FRM Exam Part II · Guidance on Managing Outsourcing Risk

Outsourcing Risk Management Program and Due Diligence

Updated 11 October 2026 · Fact-checked

An outsourcing risk management program is a lifecycle process a bank runs for every outsourced activity. It starts with a risk assessment, decides how material the arrangement is, then does due diligence on providers and selects one before any contract is signed. Higher materiality means deeper checks and tighter oversight.

Understand Outsourcing Risk Management Program and Due Diligence

Outsourcing means a bank hands an activity to an outside provider. The provider can be a third party or a group entity. The bank can pass the work to someone else. It cannot pass the accountability. The board and senior management stay responsible for the outsourced activity as if it were done in house.

Because of this, banks need a program, not one-off checks. The program follows a lifecycle: strategy and risk assessment, materiality rating, due diligence and selection, contracting, ongoing monitoring, and exit. This topic covers the first stages, up to the point of contracting.

Start with the risk assessment. Ask why you want to outsource and what could go wrong. Typical risks are operational failure, data loss, cyber breaches, compliance breaches, concentration on one provider, and reputational damage. Also ask how quickly you could bring the work back or move it if the provider fails.

Materiality sets how much effort follows. A material or critical arrangement is one where a failure or disruption could seriously harm the bank's financial position, customers, ability to meet regulatory obligations, or business continuity. Factors include how critical the activity is, how much sensitive data is involved, how hard it is to substitute the provider, the cost and volume involved, and whether the provider is concentrated across the bank or industry. The rating is reviewed over time because arrangements change.

Due diligence tests whether a provider can deliver safely. It covers financial strength, operational and technical capability, experience and reputation, information security and data protection, business continuity and resilience, legal and regulatory standing, controls and audit reports, use of subcontractors (fourth parties), and fit with the bank's risk culture. Depth scales with materiality. Selection comes after due diligence, and the results feed into contract terms.

Key formulas to remember

Accountability principle: Responsibility for outsourced activity = bank's board and senior management (not transferable); Outsourcing moves the work, not the accountability. Expect this in many questions.
Lifecycle order: Risk assessment → materiality → due diligence and selection → contract → monitoring → exit; This topic covers the stages before the contract. Know the sequence.
Proportionality rule: Higher materiality ⇒ deeper due diligence, stronger contract terms, closer monitoring; Diligence is risk-based, not identical for every vendor.
Materiality drivers: Criticality of activity + data sensitivity + substitutability + size/volume + concentration; A checklist of factors, not a numeric formula. No single factor decides.

How to solve Outsourcing Risk Management Program and Due Diligence questions

Use this method for any scenario question on outsourcing risk assessment, materiality or due diligence.

1Identify the stage of the lifecycle the question is about: assessment, materiality, due diligence, selection, or a later stage.
2Note who is accountable. The bank's board and senior management remain responsible, whatever the contract says.
3Judge materiality from the facts: how critical the activity is, data sensitivity, ease of substitution, scale and concentration.
4Match the depth of due diligence to materiality. Material arrangements need the fullest review.
5Check which due diligence areas are missing or weak: financial, operational, security, resilience, legal and regulatory, subcontractors.
6Check sequence. Due diligence and selection come before the contract, and findings shape the contract terms.
7Eliminate options that transfer accountability, skip diligence for a known or cheap provider, or rely only on price.
8Pick the option that is risk-based, documented and gives the bank ongoing control.

Quickest way: Three-question filter

When to use it: Use when time is short and options look similar.

Ask: does the option keep accountability with the bank? If it hands it to the provider, reject it.
Ask: is the effort proportional to materiality? Reject options that treat critical and trivial vendors the same.
Ask: does it happen before contracting and cover resilience, security and subcontractors, not just price? Choose the most complete one.

Common mistakes in Outsourcing Risk Management Program and Due Diligence

Saying outsourcing transfers risk and responsibility to the provider.
The contract assigns tasks and liability, so it feels like the risk has moved.
Fix: Remember that accountability stays with the board and senior management. The contract can allocate remedies, not the bank's regulatory responsibility.
Judging materiality by contract cost alone.
Cost is the easiest number to see.
Fix: Use criticality, data sensitivity, substitutability, scale and concentration. A cheap service can be critical.
Applying the same due diligence to every provider.
Students assume a standard checklist is the safest answer.
Fix: Choose a risk-based, proportional approach. Material arrangements get deeper review.
Putting due diligence after contract signing.
Confusing due diligence with ongoing monitoring.
Fix: Due diligence happens before selection and contracting. Monitoring comes after.
Ignoring fourth parties and the provider's own resilience.
Focus stays on the named vendor and its financials.
Fix: Include subcontractors, business continuity plans, and concentration in the review.
Treating materiality as a one-time label.
The rating is seen as part of onboarding only.
Fix: Reassess when scope, data, volume or the provider's situation changes.

Worked examples

Example 1

A bank plans to outsource its customer onboarding data processing to a low-cost provider. The service handles sensitive customer data, the bank has no in-house team to take it back quickly, and the provider uses a subcontractor abroad. The annual fee is small. How should the bank rate materiality and approach due diligence?

Show the solution

Check the factors: sensitive customer data is high, substitutability is low because there is no quick fallback, and a foreign subcontractor adds a fourth-party risk.
The small fee is not decisive. Materiality depends on criticality and potential harm, not cost.
Rate the arrangement as material.
Apply the deepest due diligence: financial strength, information security and data protection, business continuity, regulatory standing, and the subcontractor's controls.
Complete this before selection and contracting, and use the findings to set contract terms and an exit plan.

Answer: Rate it material despite the low fee. Do in-depth due diligence, including the subcontractor, before selecting the provider and contracting.

Example 2

A risk committee member says: 'Since we have chosen a well-known provider and the contract has strong liability clauses, the bank has transferred the outsourcing risk and needs only a light review.' Evaluate the statement.

Show the solution

Test accountability: the board and senior management stay responsible for the outsourced activity, so the risk is not transferred in a regulatory sense.
Test the reputation argument: a well-known name does not remove the need for diligence on the specific service, data and resilience.
Test proportionality: depth of review should follow materiality, not the provider's brand.
Note liability clauses give financial remedies but do not stop an outage or data breach from harming customers and the bank.
Conclude the statement is wrong on both transfer and light review.

Answer: The statement is incorrect. Accountability remains with the bank, and due diligence must be proportional to materiality regardless of provider reputation or contract liability terms.

Exam tips

Expect scenario questions where one option says responsibility moves to the provider. It is almost always wrong.
Read for materiality clues: sensitive data, no easy substitute, critical process, concentration. Then pick the option with deeper diligence.
Watch sequence words. Due diligence and selection come before contracting.
Prefer answers that are risk-based, documented and cover resilience, security and subcontractors, not just price or financials.
If two options both sound thorough, choose the one that links diligence findings to contract terms and exit planning.

Practice questions from Guidance on Managing Outsourcing Risk

Outsourcing Risk Management Program and Due Diligence in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Outsourcing Risk Management Program and Due Diligence: frequently asked questions

What are the main steps of third-party due diligence for a bank?

Assess the risk of the activity, rate materiality, then review the provider's financial strength, operational capability, security, resilience, legal and regulatory standing, and subcontractors. Select the provider after this review. Findings feed the contract.

How do you assess materiality of an outsourced activity?

Look at how critical the activity is, the sensitivity of data, how easily you could replace the provider, the scale of the service, and concentration risk. If failure could seriously harm customers, finances or regulatory compliance, treat it as material.

Does outsourcing transfer risk to the service provider?

No. The bank's board and senior management remain accountable. You can transfer the work and some financial remedies by contract, but not the responsibility.

What should a vendor due diligence checklist include for operational risk?

Include financial condition, experience, technical and operational capacity, information security and data protection, business continuity and recovery, controls and audit evidence, legal and regulatory compliance, and use of subcontractors. Depth should match materiality.