FRM Part II · FRM Exam Part II · Guidance on Managing Outsourcing Risk
A bank's board is reviewing its approach to outsourcing a core payments-processing function to an external provider. Which statement best describes the board's accountability under sound outsourcing risk guidance?
The board remains ultimately responsible for outsourced activities. It should approve the outsourcing risk framework and policy and set the risk appetite. Signing a contract does not transfer accountability to the provider, because the institution still owes regulatory and customer obligations.
- AThe board remains ultimately responsible for outsourced activities and must approve the outsourcing risk framework and policyCorrect
- BAccountability transfers to the service provider once a legally binding contract is signed
- CThe board's role ends once senior management selects the provider
- DOnly the internal audit function is accountable for oversight of outsourced activities
Explanation
Outsourcing does not relieve the institution of its obligations. The board retains ultimate accountability and should approve the framework and policy and set risk appetite for outsourcing. Transferring accountability to the provider via contract is wrong because contracts allocate service duties, not regulatory responsibility.
Did you get it right without looking?
One question tells you little. A timed set on Guidance on Managing Outsourcing Risk shows your real accuracy, how long you take and where you lose marks.
More Guidance on Managing Outsourcing Risk questions
- Several banks in a jurisdiction each use the same cloud provider for core processing, though each bank individually has only moderate depend…
- A bank outsources its loan servicing to a provider that in turn subcontracts collections to a third party. Which expectation of senior manag…
- A bank rates its outsourced activities by criticality. Its card-authorization service (provider A) would cause severe customer and regulator…
- A bank assesses its outsourcing portfolio and finds that 70% of its critical outsourced services are supplied by one provider, which is also…
- A bank outsources five critical functions. Provider A performs three of them and Provider B performs two. Provider A's cloud platform also h…
- A risk manager designs management reporting on a bank's critical outsourcing arrangements for the board. Which approach is most consistent w…