Skip to content

FRM Part II · FRM Exam Part II · Guidance on Managing Outsourcing Risk

A bank's risk committee reviews its critical outsourcing arrangements. A provider's monthly reports show all KPIs green, but the bank has never audited the provider or received independent assurance. What is the most appropriate action to strengthen oversight?

The bank should validate the provider's self-reported KPIs with independent assurance, such as third-party audit reports, and use its contractual audit and access rights. Self-reporting alone can be incomplete or biased, but immediate replacement would be disproportionate without evidence of failure.

  1. ARely on the provider's self-reported KPIs, since they are contractually binding
  2. BObtain independent assurance, such as third-party audit reports, and exercise contractual audit and access rights where appropriateCorrect
  3. CReplace the provider immediately because self-reporting is unreliable
  4. DReduce reporting frequency to limit the provider's administrative burden

Explanation

Self-reported metrics may be incomplete or biased, so oversight should be validated through independent assurance and audit/access rights. Immediate replacement is disproportionate. Reducing reporting weakens monitoring.

Did you get it right without looking?

One question tells you little. A timed set on Guidance on Managing Outsourcing Risk shows your real accuracy, how long you take and where you lose marks.

Practise Guidance on Managing Outsourcing RiskFree diagnostic mock

More Guidance on Managing Outsourcing Risk questions