Skip to content

FRM Part II · FRM Exam Part II · Guidance on Managing Outsourcing Risk

A bank's critical outsourced claims-processing service has a maximum tolerable downtime of 8 hours. The vendor's own business continuity plan states a recovery time objective of 12 hours, and the bank has never tested the plan jointly with the vendor. What is the most appropriate action by the bank's risk manager?

The risk manager should require the vendor to align its recovery objectives with the bank's 8-hour tolerance and run joint continuity tests. The 12-hour objective leaves an unmanaged gap, and credit rating, relaxed tolerances or indemnities do not ensure the critical service is actually restored in time.

  1. AAccept the plan because the vendor is a large, well-rated firm
  2. BRequire alignment of the vendor's recovery objectives with the bank's tolerance and conduct joint testingCorrect
  3. CReplace the bank's own tolerance with the vendor's 12 hours
  4. DRely on contractual indemnity to compensate any outage losses

Explanation

The vendor's 12-hour recovery exceeds the 8-hour tolerance, creating a gap. The bank should require alignment and joint testing of continuity arrangements. Raising the tolerance to fit the vendor reverses the logic, and indemnity does not restore critical services or address customer harm.

Did you get it right without looking?

One question tells you little. A timed set on Guidance on Managing Outsourcing Risk shows your real accuracy, how long you take and where you lose marks.

Practise Guidance on Managing Outsourcing RiskFree diagnostic mock

More Guidance on Managing Outsourcing Risk questions