Skip to content

FRM Part II · FRM Exam Part II · Case Study: Third-party Risk Management

A bank uses a vendor for a critical service and scores risk on a 1-5 scale. The inherent risk score is 4.0. The bank rates its combined controls (vendor controls plus bank monitoring) as reducing risk by 35%, and then, after a recent audit finding of weak subcontractor oversight, adds a 0.5 point uplift to the post-control score. What is the final residual score, and what is the most appropriate response if the bank's appetite limit for critical vendors is 3.0?

The final residual score is 3.1, which exceeds the 3.0 appetite limit. Controls cut 4.0 by 35% to 2.6, and the 0.5 uplift for weak subcontractor oversight raises it to 3.1, so remediation or an exit plan is required.

  1. A3.1; exceeds appetite, so require remediation or an exit planCorrect
  2. B2.6; within appetite, so no action is needed
  3. C3.1; within appetite, so only annual review is needed
  4. D2.1; within appetite, so no action is needed

Explanation

Post-control score = 4.0 x (1 - 0.35) = 2.6. Adding the 0.5 uplift gives 3.1. Since 3.1 exceeds the 3.0 limit, remediation or exit planning is needed. Ignoring the uplift gives 2.6, the key distractor.

Did you get it right without looking?

One question tells you little. A timed set on Case Study: Third-party Risk Management shows your real accuracy, how long you take and where you lose marks.

Practise Case Study: Third-party Risk ManagementFree diagnostic mock

More Case Study: Third-party Risk Management questions