FRM Exam Part II · Risk Mitigation

Outsourcing and Third-Party Risk Management for FRM Part II

Updated 11 October 2026 · Fact-checked

Outsourcing means hiring a third party to perform a function the firm would otherwise do itself. The firm keeps full accountability for the risk. You manage it through due diligence before signing, a clear contract with service level agreements, ongoing monitoring, concentration limits, and tested exit and continuity plans.

Understand Outsourcing and Third-Party Risk Management

Outsourcing is when a bank or fund pays an outside provider to run an activity, such as payments processing, data hosting, IT support or custody. A third party is any outside entity with a business relationship with the firm. This includes vendors, but also affiliates and other service providers.

The key principle is simple. You can hand over the work, but you cannot hand over the responsibility. The board and senior management stay accountable to regulators, clients and shareholders. Supervisors, including those applying Basel operational risk principles, expect the firm to manage a provider's risk as if the activity were in-house.

Firms outsource to cut cost, gain specialist skills, scale quickly and access technology. The price is new risks: provider failure, poor service, data breaches, loss of control, legal and compliance breaches, and dependence on a provider that is hard to replace. These are operational risks that sit outside your walls.

The risk is managed across a lifecycle. First, decide whether the activity is suitable and how critical it is. Second, perform due diligence on the provider's financial strength, controls, security, resilience, compliance record and subcontractors. Third, sign a contract with an SLA, audit and access rights, data protection terms and termination rights. Fourth, monitor performance and risk continuously. Fifth, plan the exit in advance.

Concentration risk arises when many firms rely on the same provider, or one firm relies on one provider for several critical services. A single outage then causes widespread damage. Fourth-party risk is the risk from the provider's own subcontractors. Both are common exam themes.

Key formulas to remember

Accountability rule: Outsourcing the activity ≠ outsourcing the accountability; The firm and its board remain responsible for risk, compliance and outcomes.
Availability from an SLA: Availability % = (Total time − Downtime) ÷ Total time × 100; Use the same period in numerator and denominator, for example minutes in a month.
Concentration share: Provider share = Value of critical services at one provider ÷ Total value of critical services; A high share signals concentration. Firms set internal limits and triggers.
Herfindahl-Hirschman Index (HHI): HHI = Σ (share of provider i)²; Shares as decimals. Higher means more concentrated. Equal split across n providers gives 1 ÷ n.
Service credit: Credit = contractual % of fee, set by the SLA tier breached; Credits compensate the fee, not the full business loss. They are no substitute for resilience.

How to solve Outsourcing and Third-Party Risk Management questions

Use this order for any scenario question on outsourcing or vendor risk.

1Identify the stage of the lifecycle the question is about: decision, due diligence, contract, monitoring or exit.
2Judge how critical the activity is. Critical or material functions need stronger controls.
3Confirm who is accountable. The firm and its board always are, whatever the contract says.
4Match the risk to the control: due diligence for selection, SLA and audit rights for contracts, KPIs and reporting for monitoring, exit plans for dependence.
5Check for concentration and fourth-party exposure, including a shared provider across many firms.
6If numbers are given, compute availability, share or HHI carefully and compare with the threshold.
7Choose the answer that is proactive, documented and proportionate to risk. Reject answers that shift responsibility to the vendor.

Quickest way: Lifecycle and accountability check

When to use it: Use for conceptual multiple-choice questions where several options sound reasonable.

Find the lifecycle stage in the question stem.
Eliminate any option that says responsibility transfers to the provider.
Prefer the option that acts before signing or before failure, not after.
Prefer options with independent testing, audit rights and exit planning over reliance on SLA credits.

Common mistakes in Outsourcing and Third-Party Risk Management

Believing the firm transfers risk to the vendor
The contract assigns tasks and penalties, so it feels like risk moves too.
Fix: Remember that regulatory accountability stays with the firm. A contract only allocates costs and duties.
Treating due diligence as a one-time exercise
Students link it only to selection.
Fix: Due diligence happens before onboarding and is refreshed through ongoing monitoring and periodic reviews.
Seeing SLA credits as adequate protection
Penalties look like compensation.
Fix: Credits usually cover only part of the fee. Critical services also need continuity plans, testing and exit rights.
Ignoring fourth parties
The contract is only with the first-tier provider.
Fix: Require visibility of subcontractors, flow-down of controls, and notification of changes.
Confusing diversification with removing concentration
Using two vendors seems enough.
Fix: Check whether both depend on the same cloud or infrastructure. Test substitutability and exit feasibility.
Applying identical controls to all vendors
Students want a uniform process.
Fix: Use a risk-based tiering. Critical providers get deeper reviews, more frequent monitoring and tested exits.

Worked examples

Example 1

A bank's SLA with a payments processor promises 99.9% monthly availability. The month has 30 days. The service was down for 50 minutes. Was the SLA met?

Show the solution

Total minutes = 30 × 24 × 60 = 43,200.
Allowed downtime at 99.9% = 0.1% × 43,200 = 43.2 minutes.
Actual downtime is 50 minutes, which exceeds 43.2.
Availability = (43,200 − 50) ÷ 43,200 × 100 = 99.884%, which is below 99.9%.

Answer: The SLA was breached. Availability was about 99.88% against the 99.9% target.

Example 2

A bank uses three cloud providers for critical services with these shares of critical workloads: A 60%, B 30%, C 10%. Compute the HHI and explain what it means for concentration risk.

Show the solution

Convert shares to decimals: 0.6, 0.3, 0.1.
Square each: 0.36, 0.09, 0.01.
Sum: 0.36 + 0.09 + 0.01 = 0.46.
Compare with an equal three-way split: 1 ÷ 3 = 0.333.
0.46 is well above 0.333, so reliance on provider A is high.

Answer: HHI = 0.46. Concentration is high because provider A carries 60% of critical workloads. The bank should set limits, test migration and check whether the providers share common infrastructure.

Exam tips

Questions are usually scenarios. Start by locating the lifecycle stage, then pick the control that fits it.
Any option stating that the vendor now bears the risk or accountability is almost always wrong.
Read SLA numbers carefully. Convert percentages to minutes and use the same period throughout.
For concentration questions, think about shared dependence, substitutability and exit time, not just provider count.
Expect links to operational resilience, business continuity and cyber risk. Name the concept precisely.

Practice questions from Risk Mitigation

Outsourcing and Third-Party Risk Management in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Outsourcing and Third-Party Risk Management: frequently asked questions

What is the difference between outsourcing and third-party risk?

Outsourcing is a specific arrangement where a provider performs an activity for you. Third-party risk is wider and covers any external relationship, including vendors, affiliates and other service providers. Outsourcing is one major source of it.

What should due diligence on a vendor cover?

It should cover financial strength, operational and security controls, business continuity, regulatory compliance, reputation and use of subcontractors. Depth should match how critical the service is.

What belongs in a service level agreement?

It should define measurable service levels, reporting, remedies such as service credits, incident notification, audit and access rights, data protection and termination and exit assistance. Clear metrics make monitoring possible.

How do you manage vendor concentration risk?

Map dependencies, including fourth parties. Set limits or triggers on reliance, diversify where genuinely independent, and keep tested exit and contingency plans. Report concentration to senior management.