FRM Part II · FRM Exam Part II · Guidance on Managing Outsourcing Risk
A bank relies on five critical outsourced services. Four are supplied by Vendor A, and Vendor A hosts its systems with a cloud provider that also hosts the bank's one other vendor, Vendor B. Which risk is the most significant concern that the bank's risk function should highlight?
Concentration risk, including hidden fourth-party dependence, is the main concern. Four of five critical services sit with one vendor, and both vendors rely on the same cloud provider, so one failure could disrupt nearly everything simultaneously.
- AConcentration risk, including hidden fourth-party dependence on the shared cloud providerCorrect
- BBasel market risk capital add-on for foreign exchange positions
- CInterest rate risk in the banking book
- DPure reputational risk from advertising
Explanation
Most services depend on a single vendor, and both vendors share the same underlying cloud provider. This creates direct and indirect (sub-contractor) concentration, so a single failure could disable many services at once. The other risks are unrelated to the dependency structure.
Did you get it right without looking?
One question tells you little. A timed set on Guidance on Managing Outsourcing Risk shows your real accuracy, how long you take and where you lose marks.
More Guidance on Managing Outsourcing Risk questions
- A bank's outsourcing register shows 40 material arrangements. Senior management reports to the board that all 40 have signed contracts, but …
- Several banks in a jurisdiction each use the same cloud provider for core processing, though each bank individually has only moderate depend…
- A bank outsources its loan servicing to a provider that in turn subcontracts collections to a third party. Which expectation of senior manag…
- A bank rates its outsourced activities by criticality. Its card-authorization service (provider A) would cause severe customer and regulator…
- A bank assesses its outsourcing portfolio and finds that 70% of its critical outsourced services are supplied by one provider, which is also…
- A bank outsources five critical functions. Provider A performs three of them and Provider B performs two. Provider A's cloud platform also h…