FRM Part II · FRM Exam Part II · Case Study: Third-party Risk Management
A mid-sized asset manager is considering outsourcing its fund-accounting function. Which motivation is most consistent with a sound strategic rationale for outsourcing, rather than a warning sign of weak governance?
Gaining specialised expertise and economies of scale is a sound rationale. Typical legitimate drivers are cost efficiency, skills and focus on core activities. Avoiding oversight, shifting regulatory responsibility or eliminating internal monitoring are flawed motives because the firm remains accountable and must still oversee the provider.
- AAvoiding board-level oversight of a function that has had repeated control failures
- BGaining access to specialised expertise and economies of scale that are costly to build in-houseCorrect
- CShifting regulatory responsibility for the function to the provider
- DReducing the need for any internal monitoring staff after go-live
Explanation
Legitimate drivers include cost efficiency, scale, specialist skills, and focus on core business. The other options reflect misconceptions: responsibility and oversight cannot be outsourced, and monitoring staff are still needed.
Did you get it right without looking?
One question tells you little. A timed set on Case Study: Third-party Risk Management shows your real accuracy, how long you take and where you lose marks.
More Case Study: Third-party Risk Management questions
- A regional bank contracts a cloud provider to host its customer-facing mobile app. After a service outage, a manager argues that because the…
- A bank's outsourced call-centre vendor has an SLA requiring 99.5% availability over a 30-day month (720 hours). In the month, the vendor rec…
- A bank is drafting a contract with a vendor supporting a critical payments function. Which provision most directly supports the termination …
- A regional bank relies on a single cloud provider to host its payment processing platform. The provider suffers a multi-day outage, and the …
- A bank assesses 10 critical applications. Cloud Provider A hosts 4, Provider B hosts 3, Provider C hosts 2 and Provider D hosts 1. Using the…
- During ongoing monitoring, a bank notes that a critical cloud provider has begun subcontracting its data-hosting to a fourth party in anothe…