Skip to content

FRM Part II · FRM Exam Part II · Case Study: Third-party Risk Management

A bank wants to reduce the risk that a single cloud provider outage disrupts a critical service with a short impact tolerance. Which action most directly addresses this concentration risk while remaining consistent with sound third-party risk management?

The best action is to develop and test an exit and substitution plan, including portability of workloads to another provider or an in-house fallback. This reduces dependence on one cloud provider and allows the critical service to continue within impact tolerance if that provider fails.

  1. ADevelop and test an exit and substitution plan, including workload portability to an alternative provider or on-premises fallbackCorrect
  2. BRely on the provider's published availability percentage as sufficient assurance
  3. CReplace the contract's service-level agreement with a longer notice period
  4. DIncrease the bank's operational risk insurance cover and take no further action

Explanation

Concentration risk is reduced by being able to switch or fail over, so tested exit and substitution plans with portability are the direct control. Published availability is a vendor claim and does not remove dependency. A longer notice period or insurance may help recovery financially but does not preserve the service within tolerance.

Did you get it right without looking?

One question tells you little. A timed set on Case Study: Third-party Risk Management shows your real accuracy, how long you take and where you lose marks.

Practise Case Study: Third-party Risk ManagementFree diagnostic mock

More Case Study: Third-party Risk Management questions