FRM Part II · FRM Exam Part II · Guidance on Managing Outsourcing Risk
A bank outsources 60% of a critical function to Provider A and 40% to Provider B. Both providers use the same cloud infrastructure vendor, which suffers a 36-hour outage. The bank's board had viewed the two-provider setup as full diversification. Which conclusion is most appropriate for the risk manager?
The arrangement carries hidden concentration risk. Both providers depend on the same cloud infrastructure vendor, so one outage hit both at once, and having two contracts overstated diversification. Risk managers should map fourth-party dependencies and assess common points of failure, not just count providers.
- AThe arrangement has hidden concentration risk because both providers share a common underlying dependency, so provider count overstates diversificationCorrect
- BDiversification was effective because two contracts exist, and the outage is purely a provider issue
- CThe bank should cancel Provider B only, since the 40% share caused the outage
- DThe risk is eliminated by raising the contract penalty clauses, since financial compensation restores operations
Explanation
Concentration risk arises from common dependencies, not only from the number of contracts. Both providers fail together if they share the same infrastructure vendor, so the diversification is illusory. Penalty clauses compensate but do not restore service, and the split shares are irrelevant to the cause.
Did you get it right without looking?
One question tells you little. A timed set on Guidance on Managing Outsourcing Risk shows your real accuracy, how long you take and where you lose marks.
More Guidance on Managing Outsourcing Risk questions
- A bank's board is reviewing its outsourcing framework. Which of the following is most appropriately a board-level responsibility rather than…
- A bank outsources a critical function to Vendor A, which relies on subcontractor B for data hosting. Vendor A has a tested continuity plan, …
- A mid-sized bank plans to outsource its loan-servicing operations to an external provider. Under supervisory guidance on managing outsourcin…
- A bank negotiating an outsourcing contract for a critical function wants to preserve its ability to manage risk and exit the arrangement in …
- Which item is most appropriately the responsibility of the board, rather than of operational vendor managers, in an outsourcing framework?
- After a provider of a bank's critical cloud services suffers a prolonged outage, the board asks what senior management should have establish…