FRM Part II · FRM Exam Part II · Case Study: Third-party Risk Management
A regional bank discovers that its payments processing, fraud monitoring and customer onboarding vendors all run their production workloads on the same cloud provider. Which type of risk does this arrangement most directly illustrate?
This is fourth-party concentration risk. The bank's separate vendors all rely on one cloud provider, so a single outage or breach at that provider could disable several critical services simultaneously, even though the bank has no direct contract with it.
- AFourth-party concentration risk arising from a shared underlying providerCorrect
- BResidual risk arising from effective vendor controls
- CBasis risk between vendor service fees and market rates
- DSettlement risk arising from delayed securities delivery
Explanation
Several vendors depend on one cloud provider that the bank does not contract with directly, so that provider is a fourth party. A failure there could disrupt multiple services at once, which is concentration risk. The other options describe unrelated risks.
Did you get it right without looking?
One question tells you little. A timed set on Case Study: Third-party Risk Management shows your real accuracy, how long you take and where you lose marks.
More Case Study: Third-party Risk Management questions
- After a vendor failure disrupted a bank's customer onboarding service, the board asks how to define impact tolerance for that important busi…
- A bank assesses an outsourced critical service. The primary vendor has a 2% annual probability of a disruption exceeding the bank's impact t…
- Which role is the internal audit function expected to perform with respect to a bank's third-party risk management framework?
- A bank's third-party risk policy requires an exit strategy for critical outsourced services. A regulator reviewing the bank finds that the s…
- A bank's critical service has an impact tolerance of 8 hours. Its vendor contract guarantees recovery within 6 hours, but the vendor depends…
- A bank's second line of defense reviews its third-party risk management. Which arrangement best aligns with the three-lines model for outsou…