Skip to content

FRM Part II · FRM Exam Part II · Case Study: Third-party Risk Management

A bank discovers that its critical vendor outsources part of the service to a subcontractor, which then fails. The bank had only assessed the vendor's direct controls. What weakness does this most clearly reveal?

It reveals inadequate visibility into fourth-party dependencies. The bank assessed only the direct vendor, so it did not know that a subcontractor supported the critical service. Sound third-party risk management requires mapping and monitoring the vendor's material subcontracting chain.

  1. AInadequate visibility into fourth-party (subcontractor) dependenciesCorrect
  2. BExcessive diversification across vendors
  3. COverly frequent vendor performance reporting
  4. DToo much capital allocated to operational risk

Explanation

The failure came through a subcontractor of the vendor, a fourth party, which the bank had not mapped or assessed. Diversification, frequent reporting and capital levels do not explain the gap in supply chain visibility.

Did you get it right without looking?

One question tells you little. A timed set on Case Study: Third-party Risk Management shows your real accuracy, how long you take and where you lose marks.

Practise Case Study: Third-party Risk ManagementFree diagnostic mock

More Case Study: Third-party Risk Management questions