Skip to content

FRM Part II · FRM Exam Part II · Case Study: Third-party Risk Management

A bank notices that several of its critical vendors all rely on the same cloud infrastructure provider. Which risk is this most directly describing, and which metric would best monitor it?

This is fourth-party concentration risk, because several critical vendors depend on one cloud provider, so a single failure could cascade. The best metric is the proportion of critical services reliant on that single underlying provider, which quantifies the shared dependency.

  1. AFourth-party concentration risk; the share of critical services dependent on a single underlying providerCorrect
  2. BVendor pricing risk; the average contract cost per vendor
  3. CLegal risk; the number of contracts with arbitration clauses
  4. DReputation risk; the volume of social media complaints

Explanation

Multiple vendors depending on one underlying provider creates concentration through fourth parties, so a single failure could disrupt many services at once. Tracking the share of critical services dependent on that provider measures it. The other options address unrelated risks.

Did you get it right without looking?

One question tells you little. A timed set on Case Study: Third-party Risk Management shows your real accuracy, how long you take and where you lose marks.

Practise Case Study: Third-party Risk ManagementFree diagnostic mock

More Case Study: Third-party Risk Management questions