Skip to content

FRM Part II · FRM Exam Part II · Case Study: Third-party Risk Management

A bank's critical service has an impact tolerance of 8 hours. Its vendor contract guarantees recovery within 6 hours, but the vendor depends on a subcontractor whose own recovery time is 5 hours, and the subcontractor's recovery only starts after the vendor has detected the failure, which takes 2 hours. Assuming sequential steps with detection first, then the subcontractor recovery, then the vendor's own 6-hour recovery process beginning only after the subcontractor is restored, what is the total expected restoration time and what is the conclusion?

Total restoration time is 13 hours, from 2 hours detection plus 5 hours subcontractor recovery plus 6 hours vendor recovery. This exceeds the 8-hour impact tolerance, so it is breached. The contractual 6-hour guarantee ignores the fourth-party dependency and detection delay, giving false comfort.

  1. A13 hours; the impact tolerance of 8 hours is breachedCorrect
  2. B6 hours; within tolerance
  3. C11 hours; within tolerance
  4. D13 hours; within tolerance because the contract guarantees 6 hours

Explanation

Sequential steps: 2 hours detection + 5 hours subcontractor recovery + 6 hours vendor recovery = 13 hours. This exceeds the 8-hour tolerance, so the contractual 6-hour figure alone gives false comfort because it ignores the fourth-party dependency and detection delay. Option 3 omits the vendor recovery step.

Did you get it right without looking?

One question tells you little. A timed set on Case Study: Third-party Risk Management shows your real accuracy, how long you take and where you lose marks.

Practise Case Study: Third-party Risk ManagementFree diagnostic mock

More Case Study: Third-party Risk Management questions