Skip to content

FRM Part II · FRM Exam Part II · Risk Mitigation

A bank discovers that its critical vendor relies on a subcontractor (a fourth party) to host client data. What is the most appropriate response under sound third-party risk practice?

The bank should require the vendor to disclose and manage subcontracting, keeping visibility and oversight of material fourth parties. Contract terms should flow down controls, because the bank remains accountable for the service even when the vendor uses subcontractors.

  1. AIgnore it, since the bank has no contract with the subcontractor
  2. BRequire the vendor contractually to disclose and manage subcontracting, with the bank retaining visibility and oversight of material subcontractorsCorrect
  3. CTerminate the vendor immediately regardless of the risk assessment
  4. DAsk the subcontractor to assume the bank's regulatory obligations

Explanation

Subcontracting can add risk and reduce transparency. The bank should ensure contracts require disclosure, flow-down of controls and oversight of material subcontractors. Ignoring it leaves risk unmanaged, automatic termination is disproportionate, and regulatory obligations cannot be transferred to a subcontractor.

Did you get it right without looking?

One question tells you little. A timed set on Risk Mitigation shows your real accuracy, how long you take and where you lose marks.

Practise Risk MitigationFree diagnostic mock

More Risk Mitigation questions