FRM Part II · FRM Exam Part II · Case Study: Third-party Risk Management
A regional bank moves its customer-complaint handling to an external call-centre provider. Under widely accepted third-party risk principles, which statement best describes the bank's accountability for complaint-handling outcomes after the move?
The bank keeps ultimate accountability. Outsourcing moves the performance of the activity to the provider but not the responsibility for it, so the board and senior management remain answerable to customers and supervisors, regardless of contractual liability allocations between the parties.
- AAccountability transfers to the provider once a signed contract is in place
- BAccountability is shared equally between the bank and the provider's regulator
- CThe bank retains ultimate accountability for the activity and its compliance outcomesCorrect
- DAccountability rests with the provider for operational failures but with the bank for strategic failures only
Explanation
Outsourcing transfers the performance of an activity, not responsibility for it. The board and senior management of the bank remain accountable to customers and supervisors. The first option is wrong because a contract can allocate liability between the parties but cannot remove regulatory accountability.
Did you get it right without looking?
One question tells you little. A timed set on Case Study: Third-party Risk Management shows your real accuracy, how long you take and where you lose marks.
More Case Study: Third-party Risk Management questions
- A bank uses a scorecard to rank vendors by residual risk. Inherent risk is scored 1-5 and control effectiveness reduces it by a factor: resi…
- A mid-sized asset manager is deciding whether to outsource its fund accounting function. Which of the following is the most typical strategi…
- A bank sets an impact tolerance of 8 hours maximum disruption for a critical payments service. A scenario test of a vendor failure shows: ve…
- A regional bank relies on a single cloud provider to host its payment processing platform. The provider suffers a prolonged outage, and the …
- Under the shared responsibility model for infrastructure-as-a-service cloud arrangements, which item generally remains the bank's responsibi…
- A bank's board is reviewing its third-party risk framework. Which of the following is the most appropriate responsibility for the board itse…