FRM Part II · FRM Exam Part II · Guidance on Managing Outsourcing Risk
A bank outsources a critical function to a provider that itself relies on a subcontractor (a fourth party). Which action best addresses the resulting continuity and concentration concern?
The bank should obtain visibility of material subcontracting, require resilience and audit obligations to flow down, and check whether several of its providers depend on the same subcontractor. This addresses hidden concentration while preserving the bank's accountability for the function.
- AIgnore the subcontractor since the contract is only with the primary provider
- BRequire visibility of material subcontracting, flow-down of resilience and audit rights, and consider whether multiple providers depend on the same subcontractorCorrect
- CProhibit all outsourcing to providers that use any subcontractor
- DRely solely on the provider's assertion that it manages its own subcontractors
Explanation
The bank remains accountable for the outsourced function, so it needs visibility into material subcontracting, contractual flow-down of requirements and audit rights, and awareness of hidden concentration where several providers share a subcontractor. A blanket prohibition is impractical and assertion alone is insufficient.
Did you get it right without looking?
One question tells you little. A timed set on Guidance on Managing Outsourcing Risk shows your real accuracy, how long you take and where you lose marks.
More Guidance on Managing Outsourcing Risk questions
- A bank's outsourcing register shows 40 material arrangements. Senior management reports to the board that all 40 have signed contracts, but …
- Several banks in a jurisdiction each use the same cloud provider for core processing, though each bank individually has only moderate depend…
- A bank outsources its payment processing to a single vendor. The board asks which document should primarily define how the bank would move t…
- A bank outsources its loan servicing to a provider that in turn subcontracts collections to a third party. Which expectation of senior manag…
- A bank rates its outsourced activities by criticality. Its card-authorization service (provider A) would cause severe customer and regulator…
- A bank assesses its outsourcing portfolio and finds that 70% of its critical outsourced services are supplied by one provider, which is also…