FRM Part II · FRM Exam Part II · Case Study: Third-party Risk Management
A bank outsources its customer onboarding checks to a vendor, which in turn uses a subcontractor in another jurisdiction for document verification. The bank's compliance head asks what governance is required regarding the subcontractor. Which response best reflects supervisory expectations?
The bank should make sure its vendor contract addresses subcontracting, with notification or approval rights and flow-down of control requirements, and should assess risk across the chain. Lacking a direct contract with the subcontractor does not remove the bank's responsibility, and attestation alone is not adequate oversight.
- ANo action is required because the bank has no contract with the subcontractor
- BThe bank should ensure the contract with the vendor covers subcontracting, including notification or approval rights and flow-down of controls, and the bank should assess the chain riskCorrect
- CThe bank should replace the vendor with a subcontractor to shorten the chain
- DOnly the vendor is accountable, so the bank should rely on the vendor's attestation alone
Explanation
Supervisors expect banks to understand and manage fourth-party and subcontracting risk, typically via contract terms on subcontracting, flow-down of requirements and visibility into the chain. Having no direct contract does not remove the risk, and sole reliance on attestation is insufficient.
Did you get it right without looking?
One question tells you little. A timed set on Case Study: Third-party Risk Management shows your real accuracy, how long you take and where you lose marks.
More Case Study: Third-party Risk Management questions
- A bank's vendor risk team discovers that three of its critical service providers, each assessed as independent, all rely on the same subcont…
- A bank's outsourced call-centre vendor has an SLA requiring 99.5% availability over a 30-day month (720 hours). In the month, the vendor rec…
- A bank plans to outsource its payment-processing function to a vendor that itself relies on a subcontractor in another jurisdiction. Which r…
- A bank is drafting a contract with a vendor supporting a critical payments function. Which provision most directly supports the termination …
- A bank's contract with a payment processor sets a service-level target of 99.9% availability over a 30-day month (43,200 minutes). In the mo…
- A bank assesses 10 critical applications. Cloud Provider A hosts 4, Provider B hosts 3, Provider C hosts 2 and Provider D hosts 1. Using the…