Skip to content

FRM Part II · FRM Exam Part II · Case Study: Third-party Risk Management

A bank's second line of defense reviews its third-party risk management. Which arrangement best aligns with the three-lines model for outsourcing governance?

Business units, as the first line, own and manage vendor risks; the risk and compliance function, as the second line, sets the framework and challenges; internal audit, as the third line, provides independent assurance. This preserves independence and clear ownership across outsourcing governance.

  1. ABusiness units own and manage the vendor relationship risks, the risk/compliance function sets the framework and challenges, and internal audit independently assesses the frameworkCorrect
  2. BInternal audit selects vendors and monitors their performance daily
  3. CThe risk function owns each vendor relationship and the business units provide independent assurance
  4. DBusiness units both manage vendor risks and independently audit them to save cost

Explanation

In the three-lines model the first line owns and manages risk, the second line sets policy and provides oversight and challenge, and the third line provides independent assurance. Other options give audit operational duties or remove independence.

Did you get it right without looking?

One question tells you little. A timed set on Case Study: Third-party Risk Management shows your real accuracy, how long you take and where you lose marks.

Practise Case Study: Third-party Risk ManagementFree diagnostic mock

More Case Study: Third-party Risk Management questions