FRM Part II · FRM Exam Part II · Case Study: Third-party Risk Management
A regional bank contracts a cloud provider to host its customer-facing mobile app. After a service outage, a manager argues that because the provider was at fault, the bank's responsibility for the affected customers has ended. Under standard supervisory guidance on outsourcing and third-party risk, which statement is most accurate?
The bank remains ultimately accountable. Outsourcing moves the execution of an activity to a provider, but responsibility for managing its risks and for customer outcomes stays with the bank's board and senior management, regardless of contract terms or provider certifications.
- AThe bank remains ultimately accountable for the outsourced activity and its effects on customersCorrect
- BAccountability transfers to the provider once a written service contract is signed
- CAccountability is shared equally between the bank and the provider by regulation
- DAccountability rests with the provider if it holds an independent security certification
Explanation
Supervisory guidance holds that outsourcing transfers the performance of an activity, not the accountability for it. The board and senior management stay responsible for risks to the bank and its customers. A contract or a certification does not shift that responsibility, and regulation does not impose an equal split.
Did you get it right without looking?
One question tells you little. A timed set on Case Study: Third-party Risk Management shows your real accuracy, how long you take and where you lose marks.
More Case Study: Third-party Risk Management questions
- A bank outsources its customer onboarding checks to a vendor, which in turn uses a subcontractor in another jurisdiction for document verifi…
- A bank's vendor contract for a customer-data hosting service contains a service level agreement (SLA). Which contract clause would most dire…
- After a vendor failure disrupts a bank's customer onboarding service, the board asks how operational resilience differs from traditional ope…
- A bank's vendor risk team discovers that three of its critical service providers, each assessed as independent, all rely on the same subcont…
- Which statement best describes the purpose of pre-contract due diligence on a prospective critical vendor?
- A bank's board is reviewing its third-party risk management framework. Which responsibility is most appropriately retained by the board rath…