Skip to content

FRM Part II · FRM Exam Part II · Guidance on Managing Outsourcing Risk

A bank outsources its customer data hosting to a cloud provider that itself uses a subcontractor in another jurisdiction. Senior management learns the subcontractor had a security breach, and the contract lacks audit rights over subcontractors. Which response best reflects management's responsibilities?

Management should escalate appropriately, assess the impact on customers and regulatory compliance, renegotiate or enforce rights over subcontractor visibility and audit, and review contingency and exit plans. Accountability stays with the bank, so ignoring the incident or terminating every arrangement indiscriminately would be inadequate or disproportionate.

  1. ATreat the breach as the provider's problem since the contract places service delivery on the provider
  2. BWait for the provider's annual report before taking any action
  3. CEscalate to the board as appropriate, assess impact on customers and compliance, invoke or renegotiate contractual rights for subcontractor visibility, and review the exit and contingency planCorrect
  4. DTerminate all outsourcing arrangements immediately regardless of materiality

Explanation

Management stays responsible for the risk, including fourth-party exposure. It should assess impact, escalate, seek stronger audit and notification rights over subcontractors, and test contingency and exit plans. Passing blame ignores retained accountability; terminating everything is disproportionate and itself creates risk.

Did you get it right without looking?

One question tells you little. A timed set on Guidance on Managing Outsourcing Risk shows your real accuracy, how long you take and where you lose marks.

Practise Guidance on Managing Outsourcing RiskFree diagnostic mock

More Guidance on Managing Outsourcing Risk questions