Skip to content

FRM Part II · FRM Exam Part II · Guidance on Managing Outsourcing Risk

A bank outsources a critical function and the provider subcontracts part of it to a fourth party. Which contract design best manages the resulting risk?

Require notification or approval of material subcontracting, flow down equivalent obligations including audit and security terms, and keep the primary provider responsible for the subcontractor. The bank always retains accountability, so silence or shifting responsibility leaves the chain of risk uncontrolled.

  1. ASilent contract, since the primary provider is liable anyway
  2. BProhibit all subcontracting regardless of the service
  3. CRequire prior notification or approval of material subcontracting, flow-down of equivalent obligations, and the provider's continued responsibility for the subcontractorCorrect
  4. DTransfer accountability for the function to the subcontractor

Explanation

The bank remains accountable for outsourced activities. Contracts should control material subcontracting, flow down security, audit and performance obligations, and keep the primary provider responsible. A blanket ban is rarely practical and silence leaves risk unmanaged.

Did you get it right without looking?

One question tells you little. A timed set on Guidance on Managing Outsourcing Risk shows your real accuracy, how long you take and where you lose marks.

Practise Guidance on Managing Outsourcing RiskFree diagnostic mock

More Guidance on Managing Outsourcing Risk questions