FRM Part II · FRM Exam Part II · Case Study: Third-party Risk Management
A mid-sized bank plans to outsource its loan-servicing platform to a cloud provider. Under supervisory guidance on managing outsourcing risk, which statement best describes where accountability for the outsourced activity rests?
Accountability stays with the bank's board and senior management. Outsourcing moves the performance of the activity, not the responsibility for it. The bank must oversee the provider and ensure the activity meets the same standards and legal requirements as if it were done internally.
- AWith the service provider, because it performs the activity under the contract
- BWith the bank's board and senior management, who remain responsible for the activity as if it were performed in-houseCorrect
- CWith the external auditor, who must certify the provider's controls
- DWith the regulator, who approves the outsourcing arrangement
Explanation
Supervisory guidance is clear that outsourcing does not transfer responsibility. The board and senior management stay accountable for safe and sound operation and compliance. The provider is contractually liable, but the bank cannot delegate its regulatory accountability.
Did you get it right without looking?
One question tells you little. A timed set on Case Study: Third-party Risk Management shows your real accuracy, how long you take and where you lose marks.
More Case Study: Third-party Risk Management questions
- After a vendor failure disrupted a bank's customer onboarding service, the board asks how to define impact tolerance for that important busi…
- A regional bank relies on a single cloud provider to host its payment processing platform. The provider suffers a prolonged outage, and the …
- Under the shared responsibility model for infrastructure-as-a-service cloud arrangements, which item generally remains the bank's responsibi…
- Which role is the internal audit function expected to perform with respect to a bank's third-party risk management framework?
- A regional bank uses a single cloud provider to host its core banking, payments and fraud-detection systems. Which description best captures…
- A bank's third-party risk policy requires an exit strategy for critical outsourced services. A regulator reviewing the bank finds that the s…