Skip to content

FRM Part II · FRM Exam Part II · Case Study: Third-party Risk Management

A bank has five critical services. Service dependency mapping shows: Provider A supports 3 services, Provider B supports 2 services, and Provider C's cloud hosts the platforms of both A and B. If Provider C suffers a prolonged outage, how many of the five critical services are exposed, and what does this show?

All five services are exposed. Providers A and B, which support 3 and 2 services respectively, both run on Provider C's cloud, so C's outage cascades to everything. This reveals hidden fourth-party concentration even though the bank has no direct contract with C.

  1. A2 services; only B's direct services are affected
  2. B3 services; only A's services are affected
  3. C5 services; hidden fourth-party concentration at Provider CCorrect
  4. D0 services; the bank has no contract with C

Explanation

A's 3 services plus B's 2 services total 5, and both depend on C's cloud. The bank has no direct contract with C, yet it bears the exposure. Lack of contract does not remove the dependency, so option 4 is wrong.

Did you get it right without looking?

One question tells you little. A timed set on Case Study: Third-party Risk Management shows your real accuracy, how long you take and where you lose marks.

Practise Case Study: Third-party Risk ManagementFree diagnostic mock

More Case Study: Third-party Risk Management questions