FRM Part II · FRM Exam Part II · Guidance on Managing Outsourcing Risk
A bank's SLA for a card-authorization service has a monthly fee of USD 400,000. Service credits are: 5% of the fee if availability is below 99.9% but at least 99.5%; 10% if below 99.5% but at least 99.0%; 25% if below 99.0%. In a 30-day month (43,200 minutes) the provider suffered two outages of 150 minutes and 90 minutes. What credit is due, and what is the bank's main residual issue?
The credit is USD 40,000. Total downtime of 240 minutes gives availability of about 99.44%, which falls in the 10% tier, and 10% of USD 400,000 is USD 40,000. The main residual issue is that such credits are typically small compared with the bank's actual losses and reputational damage.
- AUSD 40,000; credits fully cover the bank's losses
- BUSD 100,000; the bank must terminate immediately
- CUSD 20,000; credits are an exclusive remedy, so no other recovery is possible
- DUSD 40,000; credits are likely small relative to the bank's operational losses and reputational harmCorrect
Explanation
Downtime is 240 minutes. 240/43,200 = 0.556%, so availability is 99.444%. That is below 99.5% but at least 99.0%, so the 10% tier applies: 0.10 x 400,000 = USD 40,000. The 5% tier (USD 20,000) misreads the band. Credits are usually modest compared with losses from failed transactions and customer harm, so they do not replace resilience planning.
Did you get it right without looking?
One question tells you little. A timed set on Guidance on Managing Outsourcing Risk shows your real accuracy, how long you take and where you lose marks.
More Guidance on Managing Outsourcing Risk questions
- A bank relies on an outsourced data-center provider for a critical trading platform. The bank's business impact analysis sets a maximum tole…
- A bank outsources 60% of a critical function to Provider A and 40% to Provider B. Both providers use the same cloud infrastructure vendor, w…
- A bank outsources a critical function to a provider that itself relies on a subcontractor (a fourth party). Which action best addresses the …
- A bank's risk committee reviews its critical outsourcing arrangements. A provider's monthly reports show all KPIs green, but the bank has ne…
- A bank's vendor risk team reviews a critical cloud provider. Monthly service level reports show 99.95% availability against a 99.9% target, …
- A bank uses 40 critical outsourced services. Monitoring intensity is set by a score: Tier 1 (score above 80) is reviewed quarterly, Tier 2 (…