Skip to content

FRM Part II · FRM Exam Part II · Case Study: Third-party Risk Management

A mid-sized bank relies on a single cloud provider to host its payments platform, core ledger and customer authentication service. The risk team flags this as a concentration risk. Which description best captures why this arrangement is a concern?

The concern is that one outage or failure at the single cloud provider could disrupt payments, the ledger and authentication simultaneously. Concentrating critical services with one vendor creates a single point of failure and correlated impact, which is the essence of third-party concentration risk.

  1. AA single outage or failure at the provider could disrupt several critical services at onceCorrect
  2. BThe provider's fees are likely to rise each year
  3. CThe bank cannot audit its own internal systems
  4. DCloud hosting always has higher availability than on-premises hosting

Explanation

Concentration risk arises when many critical functions depend on one provider, so one failure can cause correlated disruption across them. Cost escalation is a commercial matter and not the concentration concern. The claim that cloud always has higher availability is untrue and ignores the single point of failure.

Did you get it right without looking?

One question tells you little. A timed set on Case Study: Third-party Risk Management shows your real accuracy, how long you take and where you lose marks.

Practise Case Study: Third-party Risk ManagementFree diagnostic mock

More Case Study: Third-party Risk Management questions