Skip to content

FRM Part II · FRM Exam Part II · Case Study: Third-party Risk Management

A bank's vendor contract for a customer-data hosting service contains a service level agreement (SLA). Which contract clause would most directly allow the bank to verify the vendor's control environment independently, rather than relying only on vendor self-reporting?

A right-to-audit clause that extends to material subcontractors gives the bank independent verification of the vendor's controls. Liability caps, force majeure and automatic renewal clauses do not provide assurance; they limit vendor responsibility or set commercial terms, so they cannot replace direct inspection rights.

  1. AA limitation of liability clause capping damages at annual fees
  2. BA right-to-audit clause covering the vendor and its material subcontractorsCorrect
  3. CA force majeure clause excusing delays from external events
  4. DAn automatic renewal clause extending the term unless cancelled

Explanation

A right-to-audit clause lets the bank or its regulators inspect the vendor and relevant subcontractors, giving independent assurance. The liability cap and force majeure clauses limit vendor obligations, and auto-renewal is a commercial term. None provide verification.

Did you get it right without looking?

One question tells you little. A timed set on Case Study: Third-party Risk Management shows your real accuracy, how long you take and where you lose marks.

Practise Case Study: Third-party Risk ManagementFree diagnostic mock

More Case Study: Third-party Risk Management questions