Skip to content

FRM Part II · FRM Exam Part II · Guidance on Managing Outsourcing Risk

A bank outsources its customer data hosting to a cloud provider that in turn relies on a subcontractor in another jurisdiction. The bank's risk manager is reviewing the contract and ongoing oversight design. Which approach is MOST consistent with supervisory guidance?

The bank should set contract terms covering subcontracting: notification and approval rights, flow-down of security, audit and data-protection requirements, and monitoring of fourth-party and concentration risk. Ignoring subcontractors, banning them outright, or reviewing only financials does not give adequate control over risk the bank still owns.

  1. AAccept the provider's assurance that subcontractors are its sole concern, since the bank has no contract with them
  2. BRequire contract terms on subcontracting, including notification and approval rights, flow-down of security and audit requirements, and monitoring of concentration and fourth-party riskCorrect
  3. CProhibit all subcontracting regardless of cost or provider capability
  4. DLimit oversight to reviewing the provider's financial statements annually

Explanation

Guidance expects the bank to understand and control subcontracting through contract provisions and monitoring, including concentration and cross-border issues. Ignoring fourth parties leaves risk unmanaged, a blanket ban is not required, and financial review alone is insufficient.

Did you get it right without looking?

One question tells you little. A timed set on Guidance on Managing Outsourcing Risk shows your real accuracy, how long you take and where you lose marks.

Practise Guidance on Managing Outsourcing RiskFree diagnostic mock

More Guidance on Managing Outsourcing Risk questions