FRM Part II · FRM Exam Part II · Case Study: Third-party Risk Management
A bank's board is reviewing its third-party risk framework. Which of the following is the most appropriate responsibility for the board itself, as opposed to business-line management, under supervisory outsourcing guidance?
The board should approve the risk appetite and outsourcing policy and receive regular reporting on material third-party arrangements. Negotiating prices, daily SLA monitoring and technical control testing are management-level execution tasks, whereas the board's role is setting direction and overseeing that the framework works.
- AApproving the risk appetite and the outsourcing policy, and receiving regular reporting on material third-party arrangementsCorrect
- BNegotiating the pricing terms of each individual vendor contract
- CPerforming day-to-day monitoring of vendor service-level metrics
- DConducting on-site technical testing of each provider's controls
Explanation
The board sets strategy, risk appetite and approves policy, and oversees material arrangements through reporting. Pricing negotiation, daily SLA monitoring and technical testing are operational tasks delegated to management and functions. The distractors confuse oversight with execution.
Did you get it right without looking?
One question tells you little. A timed set on Case Study: Third-party Risk Management shows your real accuracy, how long you take and where you lose marks.
More Case Study: Third-party Risk Management questions
- Following a vendor failure, a bank's review finds its contract lacked exit provisions, audit rights and incident notification timelines. At …
- During due diligence on a cloud provider that will host a critical payments application, a risk manager finds the provider relies on a subco…
- A bank outsources its customer onboarding checks to a vendor, which in turn uses a subcontractor in another jurisdiction for document verifi…
- A bank has a critical service with an impact tolerance of 8 hours. During a vendor failure test, detection takes 1.5 hours, the decision to …
- A bank's contract with a critical vendor expires in 6 months and the vendor has had repeated service-level breaches. Which action best refle…
- Following a vendor failure, a bank wants its exit strategy for a critical outsourced service to be credible. Which element is most important…