Skip to content

FRM Part II · FRM Exam Part II · Case Study: Third-party Risk Management

A bank's critical service runs in Region 1 of a cloud provider. The bank's resilience team proposes adding a second availability zone in the same region, with the same provider. Regulators ask whether this addresses concentration and exit risk. Which assessment is most appropriate?

Adding a second zone helps against a single data-center failure but does not remove dependence on the same provider and region. A tested exit plan or multi-provider or multi-region strategy is still needed, because accountability for resilience stays with the bank.

  1. AIt mitigates single-data-center failure but leaves provider-level and region-level dependency, so a tested exit or multi-provider strategy is still neededCorrect
  2. BIt eliminates concentration risk because data is now duplicated
  3. CIt increases concentration risk beyond any prior level and should be avoided
  4. DIt is irrelevant because the shared responsibility model transfers all resilience duties to the provider

Explanation

A second zone improves local redundancy, but the same provider, control plane and region mean common failure modes remain. Duplication does not remove provider dependency. The shared responsibility model does not transfer accountability for resilience to the provider, so exit plans and testing remain necessary.

Did you get it right without looking?

One question tells you little. A timed set on Case Study: Third-party Risk Management shows your real accuracy, how long you take and where you lose marks.

Practise Case Study: Third-party Risk ManagementFree diagnostic mock

More Case Study: Third-party Risk Management questions