FRM Part II · FRM Exam Part II · Case Study: Third-party Risk Management
A bank has a critical service with an impact tolerance of 8 hours. During a vendor failure test, detection takes 1.5 hours, the decision to invoke the contingency plan takes 2 hours, failover to the backup provider takes 3.5 hours, and data reconciliation before customers can transact takes 2 hours. All steps occur sequentially. What is the result against tolerance?
Total recovery time is 9 hours (1.5 + 2 + 3.5 + 2), which exceeds the 8-hour impact tolerance by 1 hour. Ignoring the reconciliation step would wrongly suggest 7 hours and compliance, but customers cannot transact until reconciliation is complete.
- ATotal recovery of 9 hours exceeds the tolerance by 1 hourCorrect
- BTotal recovery of 7 hours is within tolerance by 1 hour
- CTotal recovery of 9 hours exceeds the tolerance by 2 hours
- DTotal recovery of 8 hours exactly meets tolerance
Explanation
Sequential steps sum: 1.5 + 2 + 3.5 + 2 = 9 hours. Against an 8-hour tolerance, the breach is 1 hour. Omitting reconciliation gives 7 hours, wrongly within tolerance, which is the key error.
Did you get it right without looking?
One question tells you little. A timed set on Case Study: Third-party Risk Management shows your real accuracy, how long you take and where you lose marks.
More Case Study: Third-party Risk Management questions
- A bank outsources its customer onboarding checks to a vendor, which in turn uses a subcontractor in another jurisdiction for document verifi…
- Which role is the internal audit function expected to perform with respect to a bank's third-party risk management framework?
- A bank's third-party risk policy requires an exit strategy for critical outsourced services. A regulator reviewing the bank finds that the s…
- A bank's critical service has an impact tolerance of 8 hours. Its vendor contract guarantees recovery within 6 hours, but the vendor depends…
- A bank's second line of defense reviews its third-party risk management. Which arrangement best aligns with the three-lines model for outsou…
- A bank notices that several of its critical vendors all rely on the same cloud infrastructure provider. Which risk is this most directly des…