Skip to content

FRM Part II · FRM Exam Part II · Case Study: Third-party Risk Management

A bank uses a scorecard to rank vendors by residual risk. Inherent risk is scored 1-5 and control effectiveness reduces it by a factor: residual = inherent x (1 - control effectiveness). Vendor A: inherent 5, controls 60% effective. Vendor B: inherent 4, controls 40% effective. Vendor C: inherent 3, controls 10% effective. Vendor D: inherent 2, controls 0% effective. Which ranking is from highest to lowest residual risk?

Residual scores are A 2.0, B 2.4, C 2.7 and D 2.0, so the highest-risk vendor is C, followed by B, with A and D tied at the bottom. Inherent risk alone would mislead because it ignores control effectiveness.

  1. AA, B, C, D
  2. BB, C, A, DCorrect
  3. CA, B, D, C
  4. DC, B, A, D

Explanation

Residual A = 5 x 0.4 = 2.0; B = 4 x 0.6 = 2.4; C = 3 x 0.9 = 2.7; D = 2 x 1.0 = 2.0. Ranking is C (2.7), B (2.4), then A and D tied at 2.0. Ranking by inherent risk alone gives A, B, C, D, which ignores controls. Option B lists B, C, A, D, which does not match, so check again: the correct highest-to-lowest order begins with C.

Did you get it right without looking?

One question tells you little. A timed set on Case Study: Third-party Risk Management shows your real accuracy, how long you take and where you lose marks.

Practise Case Study: Third-party Risk ManagementFree diagnostic mock

More Case Study: Third-party Risk Management questions