FRM Part II · FRM Exam Part II · Guidance on Managing Outsourcing Risk
A bank's outsourcing register shows 40 material arrangements. Senior management reports to the board that all 40 have signed contracts, but the report contains no information on provider performance, incidents, exit plans or concentration. A non-executive director asks what is the main deficiency in the reporting. Which response is best?
The report is deficient because it only proves contracts exist. The board needs ongoing information on provider performance, incidents, concentration and exit readiness to oversee outsourcing risk. Without it, directors cannot judge whether exposures remain within appetite or discharge their accountability.
- AThe report is adequate because contracts transfer risk to providers
- BThe report shows legal completeness but gives the board no ongoing view of risk exposure, so it cannot fulfil its oversight dutyCorrect
- CThe report should be replaced with a single annual attestation from each provider
- DThe report should be sent to the regulator instead of the board
Explanation
Boards need regular, risk-focused information such as performance against service levels, incidents, concentration and the readiness of exit strategies. Contract existence alone does not show how risk is evolving. Provider attestations lack independence, and regulator reporting does not replace board oversight.
Did you get it right without looking?
One question tells you little. A timed set on Guidance on Managing Outsourcing Risk shows your real accuracy, how long you take and where you lose marks.
More Guidance on Managing Outsourcing Risk questions
- A risk manager is listing the main drivers behind a bank's growing use of outsourcing. Which of the following is most commonly cited as a dr…
- A bank relies on five critical outsourced services. Four are supplied by Vendor A, and Vendor A hosts its systems with a cloud provider that…
- A bank is negotiating a contract with a cloud service provider to host a critical payments application. Which contractual provision most dir…
- Several banks in a jurisdiction each use the same cloud provider for core processing, though each bank individually has only moderate depend…
- A bank outsources its loan servicing to a provider that in turn subcontracts collections to a third party. Which expectation of senior manag…
- A bank rates its outsourced activities by criticality. Its card-authorization service (provider A) would cause severe customer and regulator…