FRM Part II · FRM Exam Part II · Case Study: Third-party Risk Management
A bank maps the dependencies of its payments service and finds that three apparently independent vendors all run on the same underlying cloud region. The bank's risk team is deciding what this means for its scenario testing. Which conclusion is most appropriate?
The bank should conclude that diversification across vendors has not removed the exposure, because all three share the same cloud region. Scenario testing should assume a correlated failure of that shared fourth-party infrastructure, since the bank remains accountable for outsourced services and SLAs do not eliminate the common point of failure.
- AVendor diversification has not removed the exposure; scenario tests should assume a correlated failure of the shared fourth-party infrastructureCorrect
- BThe risk is diversified across three vendors, so the scenario should assume only one vendor fails at a time
- CFourth-party dependencies are outside the bank's responsibility once contracts are signed
- DThe bank should rely on each vendor's SLA to demonstrate resilience
Explanation
Hidden common dependencies mean vendor failures are correlated, so apparent diversification overstates resilience. Severe but plausible scenarios should include failure of the shared infrastructure. The bank retains accountability for outsourced services, and SLAs do not remove the shared point of failure.
Did you get it right without looking?
One question tells you little. A timed set on Case Study: Third-party Risk Management shows your real accuracy, how long you take and where you lose marks.
More Case Study: Third-party Risk Management questions
- Which statement best describes the purpose of pre-contract due diligence on a prospective critical vendor?
- A bank's vendor risk team discovers that three of its critical service providers, each assessed as independent, all rely on the same subcont…
- A bank's board is reviewing its third-party risk management framework. Which responsibility is most appropriately retained by the board rath…
- A bank classifies vendors by criticality using a score equal to impact (1-5) multiplied by substitutability difficulty (1-5), and applies en…
- A mid-sized bank outsources its customer call-centre operations to a vendor. A senior manager argues that because the vendor performs the ac…
- A bank's critical service is supplied by a vendor which in turn subcontracts its data hosting to a fourth party. The vendor suffers a failur…