FRM Part II · FRM Exam Part II · Case Study: Third-party Risk Management
A bank classifies vendors by criticality using a score equal to impact (1-5) multiplied by substitutability difficulty (1-5), and applies enhanced due diligence to any vendor scoring 12 or above. Vendor A: impact 4, difficulty 3. Vendor B: impact 3, difficulty 5. Vendor C: impact 5, difficulty 2. Vendor D: impact 2, difficulty 5. Which vendors require enhanced due diligence?
Only vendors A and B need enhanced due diligence. Their scores are 12 and 15, meeting the threshold of 12, while vendors C and D each score 10 and fall below it, since the score is impact multiplied by substitutability difficulty.
- AA and B onlyCorrect
- BA, B and C
- CB and C only
- DA, B, C and D
Explanation
Scores: A=4x3=12, B=3x5=15, C=5x2=10, D=2x5=10. Only A and B reach 12. Choosing C wrongly assumes high impact alone qualifies; the threshold applies to the product, so C and D fall below it.
Did you get it right without looking?
One question tells you little. A timed set on Case Study: Third-party Risk Management shows your real accuracy, how long you take and where you lose marks.
More Case Study: Third-party Risk Management questions
- A bank's vendor contract for a customer-data hosting service contains a service level agreement (SLA). Which contract clause would most dire…
- After a vendor failure disrupts a bank's customer onboarding service, the board asks how operational resilience differs from traditional ope…
- Which statement best describes the purpose of pre-contract due diligence on a prospective critical vendor?
- A bank's board is reviewing its third-party risk management framework. Which responsibility is most appropriately retained by the board rath…
- A mid-sized bank outsources its customer call-centre operations to a vendor. A senior manager argues that because the vendor performs the ac…
- A bank's critical service is supplied by a vendor which in turn subcontracts its data hosting to a fourth party. The vendor suffers a failur…