Skip to content

FRM Part II · FRM Exam Part II · Case Study: Third-party Risk Management

A bank outsources its cloud hosting to Provider A, which in turn subcontracts data storage to Provider B. A fire at B's facility interrupts the bank's services. The bank's contract with A is silent on subcontracting. Which weakness does this scenario most directly illustrate, and what is the best remedy?

This illustrates fourth-party or subcontracting risk. The best remedy is to require in the contract notification and approval of subcontractors, flow-down of control and resilience standards, and audit or visibility rights over the chain, so the bank can assess dependencies beyond its direct provider.

  1. AConcentration risk; remedy is to add a second bank as a customer of Provider A
  2. BFourth-party (subcontracting) risk; remedy is contractual requirements for notification, approval and flow-down of controls to subcontractors, plus visibility of the chainCorrect
  3. CModel risk; remedy is to recalibrate the bank's VaR model
  4. DSettlement risk; remedy is to move to delivery-versus-payment

Explanation

B is a fourth party to the bank. Without contractual rights to know about and approve subcontractors, and without flow-down of resilience standards, the bank cannot assess or control this dependency. Concentration risk is a related but different issue, and the other options are unrelated.

Did you get it right without looking?

One question tells you little. A timed set on Case Study: Third-party Risk Management shows your real accuracy, how long you take and where you lose marks.

Practise Case Study: Third-party Risk ManagementFree diagnostic mock

More Case Study: Third-party Risk Management questions