Skip to content

FRM Part II · FRM Exam Part II · Case Study: Third-party Risk Management

A bank sets an impact tolerance of 8 hours maximum disruption for a critical payments service. A scenario test of a vendor failure shows: vendor outage detection takes 1.5 hours, decision to invoke the backup provider takes 2 hours, backup activation takes 3.5 hours, and data reconciliation before customers can transact takes 2 hours. The reconciliation can begin only after activation completes, and all steps are sequential. By how much does the scenario breach the tolerance, and what is the sensible conclusion?

The total sequential time is 9 hours (1.5 + 2 + 3.5 + 2), exceeding the 8-hour tolerance by 1 hour. Because customers cannot transact until reconciliation ends, it counts, so the bank must shorten or redesign its recovery plan.

  1. A1 hour breach; the recovery plan must be redesigned or shortened to meet toleranceCorrect
  2. BNo breach; total is 7 hours
  3. C3 hours breach; reconciliation should be ignored as it is not part of recovery
  4. D0.5 hour breach; tolerance applies only to activation time

Explanation

Sequential total = 1.5 + 2 + 3.5 + 2 = 9 hours against 8, so the breach is 1 hour. Omitting reconciliation gives 7 hours (no breach), which is wrong because customers cannot transact until it finishes. Plans must be shortened, for example by pre-authorised switching decisions.

Did you get it right without looking?

One question tells you little. A timed set on Case Study: Third-party Risk Management shows your real accuracy, how long you take and where you lose marks.

Practise Case Study: Third-party Risk ManagementFree diagnostic mock

More Case Study: Third-party Risk Management questions