Skip to content

FRM Part II · FRM Exam Part II · Guidance on Managing Outsourcing Risk

A bank's outsourcing risk dashboard shows a critical vendor has met all SLA targets for four quarters. However, the vendor recently lost its key subcontractor and its audit report (SOC) contains qualified opinions on access controls. Which action is most appropriate for the bank's oversight function?

The bank should escalate, reassess the vendor's risk rating and demand remediation, including review of subcontractor dependencies. SLA compliance is a lagging measure, while qualified control opinions and loss of a key subcontractor are early warnings that need proactive oversight.

  1. ATake no action because SLA metrics are the primary evidence of performance
  2. BReduce the vendor's risk rating, as four quarters of compliance show strong control
  3. CWait until an SLA breach occurs, since contractual remedies only apply then
  4. DEscalate the findings, reassess the vendor's risk rating and request remediation plans, including review of fourth-party dependenciesCorrect

Explanation

SLA results are lagging indicators and do not capture control weaknesses or concentration in fourth parties. Qualified audit opinions and subcontractor changes are forward-looking warning signs requiring reassessment and remediation. Waiting for a breach leaves the bank exposed.

Did you get it right without looking?

One question tells you little. A timed set on Guidance on Managing Outsourcing Risk shows your real accuracy, how long you take and where you lose marks.

Practise Guidance on Managing Outsourcing RiskFree diagnostic mock

More Guidance on Managing Outsourcing Risk questions