Skip to content

FRM Part II · FRM Exam Part II · Case Study: Third-party Risk Management

A mid-sized bank outsources its customer call-centre operations to a vendor. A senior manager argues that because the vendor performs the activity and holds the contract, accountability for the associated risks has moved to the vendor. Under supervisory guidance on managing outsourcing risk, which statement is most accurate?

The bank's board and senior management remain ultimately responsible for outsourced activities. Contracts and service level agreements can assign tasks and remedies, but they cannot transfer regulatory accountability for risk to the vendor, so the bank must still oversee and control the arrangement.

  1. AThe bank's board and senior management remain ultimately responsible for the outsourced activity and its risksCorrect
  2. BAccountability passes to the vendor once a service level agreement is signed
  3. CAccountability is shared equally between the bank and the vendor by regulation
  4. DAccountability passes to the regulator when the vendor is deemed critical

Explanation

Supervisory guidance states that outsourcing does not diminish the obligations of the bank, its board, or senior management. A contract can allocate operational tasks and contractual remedies but cannot transfer regulatory accountability. The other options wrongly imply a transfer or an equal split of responsibility.

Did you get it right without looking?

One question tells you little. A timed set on Case Study: Third-party Risk Management shows your real accuracy, how long you take and where you lose marks.

Practise Case Study: Third-party Risk ManagementFree diagnostic mock

More Case Study: Third-party Risk Management questions