FRM Part II · FRM Exam Part II · Case Study: Third-party Risk Management
A regional bank plans to outsource its card-processing operations to a vendor. Which activity should the bank complete first in the third-party risk management lifecycle, before negotiating the contract?
Planning and risk assessment comes first. The bank must decide why it is outsourcing, how critical the activity is and what risks arise before selecting a vendor, performing due diligence or negotiating a contract. Monitoring and termination happen later in the lifecycle.
- APlanning and risk assessment of the outsourcing arrangement, including its criticalityCorrect
- BOngoing performance monitoring of the vendor's service levels
- CExecution of the exit strategy and transition of services
- DAnnual review of the vendor's incident reports
Explanation
The lifecycle begins with planning and risk assessment, where the bank determines the strategic rationale, criticality and risks of the activity. Due diligence, contracting, monitoring and termination follow. Monitoring and exit activities occur only after a vendor is engaged.
Did you get it right without looking?
One question tells you little. A timed set on Case Study: Third-party Risk Management shows your real accuracy, how long you take and where you lose marks.
More Case Study: Third-party Risk Management questions
- Which element is most appropriate to include in a contract with a critical third-party provider to support ongoing oversight during the life…
- A bank's board is reviewing its outsourcing policy. Which element is most consistent with sound practice for managing risk across the third-…
- A regional bank discovers that its payments processing, fraud monitoring and customer onboarding vendors all run their production workloads …
- After a vendor failure disrupted a bank's customer onboarding service, the board asks how to define impact tolerance for that important busi…
- Which role is the internal audit function expected to perform with respect to a bank's third-party risk management framework?
- A bank's third-party risk policy requires an exit strategy for critical outsourced services. A regulator reviewing the bank finds that the s…