FRM Part II · FRM Exam Part II · Case Study: Third-party Risk Management
A bank is preparing to outsource its payment-processing platform to an external vendor. Before signing the contract, the risk team wants an assessment that captures how much exposure the bank would face if the vendor failed, before considering any controls the vendor has in place. Which type of measure does this describe?
The measure is inherent risk. It captures the exposure from outsourcing a critical activity before any vendor or bank controls are taken into account. Residual risk is the exposure left after controls are applied, so it would not describe the pre-contract, pre-control assessment requested.
- AResidual risk rating
- BInherent risk ratingCorrect
- CRisk appetite threshold
- DKey control effectiveness score
Explanation
Inherent risk is the level of risk arising from the activity and its criticality before controls are considered. Residual risk is what remains after controls are applied, so it does not match the description. Appetite thresholds and control scores are not pre-control exposure measures.
Did you get it right without looking?
One question tells you little. A timed set on Case Study: Third-party Risk Management shows your real accuracy, how long you take and where you lose marks.
More Case Study: Third-party Risk Management questions
- A bank is drafting a contract with a vendor supporting a critical payments function. Which provision most directly supports the termination …
- A bank assesses 10 critical applications. Cloud Provider A hosts 4, Provider B hosts 3, Provider C hosts 2 and Provider D hosts 1. Using the…
- A bank uses a scorecard to rank vendors by residual risk. Inherent risk is scored 1-5 and control effectiveness reduces it by a factor: resi…
- A mid-sized asset manager is deciding whether to outsource its fund accounting function. Which of the following is the most typical strategi…
- A bank sets an impact tolerance of 8 hours maximum disruption for a critical payments service. A scenario test of a vendor failure shows: ve…
- A bank's board is reviewing its third-party risk framework. Which of the following is the most appropriate responsibility for the board itse…