Skip to content

FRM Part II · FRM Exam Part II · Guidance on Managing Outsourcing Risk

A bank relies on an outsourced data-center provider for a critical trading platform. The bank's business impact analysis sets a maximum tolerable outage of 4 hours. The provider's contract commits to restoring service within 6 hours and has no tested failover. What is the most appropriate action by the bank?

The bank should renegotiate recovery commitments or arrange alternative failover so recovery meets its 4-hour tolerance, and require joint testing. The tolerance is set by business impact, not by what the vendor offers, and contractual liability does not restore critical services.

  1. AAccept the contract because the provider assumes liability for any outage
  2. BReduce the maximum tolerable outage to 6 hours to match the contract
  3. CRenegotiate recovery terms or arrange alternative failover so recovery capability meets the 4-hour tolerance, and require joint testingCorrect
  4. DWait to see whether an outage occurs before changing arrangements

Explanation

The provider's recovery time of 6 hours exceeds the bank's 4-hour tolerance, creating a gap. The bank should close it through contract terms, alternative capability and joint testing. Adjusting tolerance to fit the vendor reverses the logic, and liability payments do not restore critical operations.

Did you get it right without looking?

One question tells you little. A timed set on Guidance on Managing Outsourcing Risk shows your real accuracy, how long you take and where you lose marks.

Practise Guidance on Managing Outsourcing RiskFree diagnostic mock

More Guidance on Managing Outsourcing Risk questions