Skip to content

FRM Part II · FRM Exam Part II · Guidance on Managing Outsourcing Risk

A bank outsources five critical functions. Provider A performs three of them and Provider B performs two. Provider A's cloud platform also hosts Provider B's services, though the bank did not know this. An outage at the cloud platform halts all five functions. Which risk does this scenario most directly illustrate?

The scenario shows fourth-party and concentration risk. Both providers depend on the same cloud platform, so apparent diversification across two providers was illusory, and one outage halted all five critical functions. The bank lacked visibility into the subcontracting chain.

  1. AFourth-party and concentration risk arising from hidden subcontracting dependenciesCorrect
  2. BPure counterparty credit risk on the two providers
  3. CInterest rate risk in the banking book
  4. DModel risk in the bank's internal VaR engine

Explanation

The common dependency on the same cloud platform is a fourth-party (subcontractor) exposure. It produces concentration risk because apparently diversified providers fail together. Choosing two providers did not diversify the risk since the bank lacked visibility into the chain. Credit, interest rate and model risk are not the issue.

Did you get it right without looking?

One question tells you little. A timed set on Guidance on Managing Outsourcing Risk shows your real accuracy, how long you take and where you lose marks.

Practise Guidance on Managing Outsourcing RiskFree diagnostic mock

More Guidance on Managing Outsourcing Risk questions