Skip to content

FRM Part II · FRM Exam Part II · Case Study: Third-party Risk Management

A bank's board is reviewing its third-party risk management framework. Which responsibility is most appropriately retained by the board rather than delegated entirely to business-line managers?

The board should approve the outsourcing and third-party risk policy and the risk appetite for dependence on third parties. Day-to-day negotiation, monitoring and technical specification are management tasks. The board's role is setting direction and ensuring an effective framework exists and is overseen.

  1. AApproving the risk-based outsourcing policy and the bank's risk appetite for third-party dependenceCorrect
  2. BNegotiating service-level credit terms with each vendor
  3. CPerforming daily monitoring of vendor help-desk tickets
  4. DDrafting the technical specifications of each vendor's system

Explanation

The board sets strategy, approves the policy and defines risk appetite for third-party reliance. Contract negotiation, daily monitoring and technical specifications are operational tasks delegated to management and business units. Only the policy and appetite are core board-level duties.

Did you get it right without looking?

One question tells you little. A timed set on Case Study: Third-party Risk Management shows your real accuracy, how long you take and where you lose marks.

Practise Case Study: Third-party Risk ManagementFree diagnostic mock

More Case Study: Third-party Risk Management questions