Skip to content

FRM Part II · FRM Exam Part II · Case Study: Third-party Risk Management

A bank's third-party risk policy requires an exit strategy for critical outsourced services. A regulator reviewing the bank finds that the sole provider of its payment processing has no tested transition plan and the contract has no termination-assistance clause. Which conclusion is most consistent with supervisory expectations?

This is a deficiency. Supervisors expect banks to be able to exit or transition critical outsourced services without unacceptable disruption, supported by termination-assistance clauses and tested exit plans. A provider's rating or continuity plan does not replace the bank's own exit capability, and geography is not the deciding factor.

  1. AAcceptable, as long as the provider has a strong financial rating
  2. BAcceptable, because the provider's own business continuity plan covers the bank
  3. CA deficiency, because the bank must have contractual and operational ability to exit or bring the service in-house without unacceptable disruptionCorrect
  4. DA deficiency only if the provider is located in a different country

Explanation

Supervisors expect banks to plan for provider failure or termination, including contractual termination assistance and tested exit plans for critical services. A provider's rating or its own continuity plan does not give the bank the ability to transition. Location matters for other risks but is not the trigger for this deficiency.

Did you get it right without looking?

One question tells you little. A timed set on Case Study: Third-party Risk Management shows your real accuracy, how long you take and where you lose marks.

Practise Case Study: Third-party Risk ManagementFree diagnostic mock

More Case Study: Third-party Risk Management questions