Skip to content

FRM Part II · FRM Exam Part II · Case Study: Third-party Risk Management

A bank classifies vendors by inherent risk score = impact (1-5) x likelihood (1-5). Vendor A: impact 4, likelihood 3. Vendor B: impact 5, likelihood 2. Vendor C: impact 2, likelihood 5. Vendor D: impact 3, likelihood 4. Policy requires enhanced due diligence for scores of 12 or above. Which vendors require it, and what is the main limitation of ranking only by this score?

Vendors A and D require enhanced due diligence because both score 12, while B and C score 10. The limitation is that multiplying impact and likelihood can mask low-likelihood, high-impact vendors like B, so criticality should be assessed independently of the score.

  1. AA and D only; the score may hide low-likelihood, high-impact vendors such as BCorrect
  2. BA, B and D; the score treats all equal scores as identical in criticality
  3. CA and D only; the score is unlimited in reliability
  4. DA, C and D; the score overweights impact

Explanation

Scores: A=12, B=10, C=10, D=12. So only A and D meet the threshold of 12. Vendor B has the highest impact but falls below the threshold, showing a multiplicative score can understate severe low-probability outcomes, so criticality should also be assessed separately.

Did you get it right without looking?

One question tells you little. A timed set on Case Study: Third-party Risk Management shows your real accuracy, how long you take and where you lose marks.

Practise Case Study: Third-party Risk ManagementFree diagnostic mock

More Case Study: Third-party Risk Management questions