Skip to content

FRM Part II · FRM Exam Part II · Guidance on Managing Outsourcing Risk

A bank's vendor risk team reviews a critical cloud provider. Monthly service level reports show 99.95% availability against a 99.9% target, yet the bank's own incident log shows three customer-facing outages caused by the provider's changes that were not captured in the reports. What is the most appropriate response?

The bank should reconcile the provider's reported metrics with its own incident data and use its contractual audit and information rights to close the reporting gap. Self-reported figures contradicted by independent evidence cannot be relied on, but terminating without analysis would be premature.

  1. AAccept the provider's reports because they meet the contractual target
  2. BReplace the provider immediately without further analysis
  3. CReduce monitoring frequency since the reported metric is above target
  4. DReconcile provider-reported metrics with the bank's independent data, and use audit and information rights to address the reporting gapCorrect

Explanation

Reliance solely on self-reported metrics is a weakness when independent evidence contradicts them. The bank should reconcile the sources and exercise contractual audit and information rights. Immediate termination is premature, and reducing monitoring is the opposite of what is needed.

Did you get it right without looking?

One question tells you little. A timed set on Guidance on Managing Outsourcing Risk shows your real accuracy, how long you take and where you lose marks.

Practise Guidance on Managing Outsourcing RiskFree diagnostic mock

More Guidance on Managing Outsourcing Risk questions