Skip to content

FRM Part II · FRM Exam Part II · Guidance on Managing Outsourcing Risk

A bank uses 40 critical outsourced services. Monitoring intensity is set by a score: Tier 1 (score above 80) is reviewed quarterly, Tier 2 (50-80) semi-annually, Tier 3 annually. Over a year, a provider's score rises from 45 to 85 after it subcontracts core processing to a fourth party in another jurisdiction. Which action is most appropriate?

The bank should move the provider to Tier 1 quarterly monitoring and assess the new fourth-party dependency, including visibility, controls and exit options. The score of 85 exceeds 80, and subcontracting adds risk rather than reducing it, but automatic termination is not implied.

  1. AKeep annual reviews because the contract has not changed
  2. BEscalate the provider to Tier 1 monitoring and assess the fourth-party dependency, including the bank's visibility and exit optionsCorrect
  3. CReduce the score because subcontracting spreads operational risk
  4. DTerminate the contract automatically as the score exceeds 80

Explanation

A score of 85 places the provider in Tier 1, requiring quarterly review. The new subcontracting adds fourth-party and location risk that must be assessed for visibility, controls and exit. Automatic termination is not required by the tiering, and subcontracting does not reduce risk.

Did you get it right without looking?

One question tells you little. A timed set on Guidance on Managing Outsourcing Risk shows your real accuracy, how long you take and where you lose marks.

Practise Guidance on Managing Outsourcing RiskFree diagnostic mock

More Guidance on Managing Outsourcing Risk questions