Skip to content

FRM Part II · FRM Exam Part II · Case Study: Third-party Risk Management

A bank assesses an outsourced critical service. The primary vendor has a 2% annual probability of a disruption exceeding the bank's impact tolerance. The bank considers adding a second vendor that would take over if the first fails. The second vendor has an independent 3% annual probability of failure, but both vendors rely on the same fourth-party cloud provider with a 1% annual probability of a failure that disables both vendors. Assuming the vendors' own failures are independent of each other and of the cloud failure, which is the approximate probability, to the nearest 0.01%, that the service is unavailable beyond tolerance in a year?

The probability is about 1.06%. The service fails if the shared cloud provider fails (1%) or both vendors fail independently (0.02 x 0.03 = 0.06%). Combining these gives 1 - 0.99 x 0.9994, roughly 1.06%, showing the common fourth party dominates the risk.

  1. A1.06%Correct
  2. B0.06%
  3. C1.00%
  4. D3.00%

Explanation

Service fails if the cloud fails, or both vendors fail independently. Both vendors failing = 0.02 x 0.03 = 0.0006. Combined with the cloud: 1 - (1-0.01)(1-0.0006) = 1 - 0.99 x 0.9994 = 1 - 0.989406 = 0.010594, about 1.06%. The 0.06% option ignores the shared cloud and the 1.00% option ignores vendor diversification.

Did you get it right without looking?

One question tells you little. A timed set on Case Study: Third-party Risk Management shows your real accuracy, how long you take and where you lose marks.

Practise Case Study: Third-party Risk ManagementFree diagnostic mock

More Case Study: Third-party Risk Management questions