Skip to content

FRM Part II · FRM Exam Part II · Guidance on Managing Outsourcing Risk

A bank outsources a critical function to Vendor A, which relies on subcontractor B for data hosting. Vendor A has a tested continuity plan, and the bank has a stressed-exit plan to move to Vendor C in 9 months. A regulator notes that if B fails, A's recovery depends entirely on B, and the bank's tolerance for disruption is 5 days. Which gap is most significant?

The key gap is the lack of visibility and contractual control over the subcontractor, combined with an exit plan taking 9 months against a 5-day tolerance. A fourth-party failure would cause disruption long before migration, so the bank needs sub-outsourcing oversight and short-term continuity options.

  1. AThe bank has no insurance policy covering vendor fees
  2. BVendor A's continuity plan is tested too frequently
  3. CThe exit plan has too few months allocated to vendor selection
  4. DThe bank lacks visibility and contractual control over the fourth-party dependency, and the 9-month exit cannot meet a 5-day toleranceCorrect

Explanation

Outsourcing guidance expects firms to understand and manage sub-outsourcing chains. Here the hidden fourth-party dependency could cause an outage far shorter than the 9-month exit, so a stressed exit does not address the 5-day tolerance. Testing frequency and insurance are not the key gaps.

Did you get it right without looking?

One question tells you little. A timed set on Guidance on Managing Outsourcing Risk shows your real accuracy, how long you take and where you lose marks.

Practise Guidance on Managing Outsourcing RiskFree diagnostic mock

More Guidance on Managing Outsourcing Risk questions