Skip to content

FRM Part II · FRM Exam Part II · Case Study: Third-party Risk Management

A bank's risk team is classifying its vendors. Vendor X supplies office stationery. Vendor Y hosts the bank's real-time payments platform, which cannot be restored by any alternative supplier within 48 hours. Which approach to tiering is most appropriate?

Vendor Y should be classified as critical and given enhanced due diligence, exit planning and continuous monitoring, while stationery vendor X gets lighter oversight. Oversight should be proportionate to the criticality of the service and the difficulty of substituting the provider.

  1. ATreat both identically to keep the programme simple, with annual on-site audits for each
  2. BClassify Y as critical, applying enhanced due diligence, exit planning and continuous monitoring, while X receives lighter-touch oversightCorrect
  3. CClassify X as critical because it has the highest transaction count
  4. DClassify neither as critical because both are external and therefore outside the bank's control

Explanation

Proportionality requires oversight intensity to reflect criticality and substitutability. Y supports a critical function with no quick alternative, so it warrants enhanced controls and exit planning. Treating both alike wastes resources and dilutes focus on the real risk.

Did you get it right without looking?

One question tells you little. A timed set on Case Study: Third-party Risk Management shows your real accuracy, how long you take and where you lose marks.

Practise Case Study: Third-party Risk ManagementFree diagnostic mock

More Case Study: Third-party Risk Management questions