FRM Part II · FRM Exam Part II · Case Study: Third-party Risk Management
A regional bank plans to outsource its card-processing operations to a vendor. Which activity should the bank complete first in the third-party risk management lifecycle?
The bank should first assess the strategic rationale and inherent risk of the outsourcing and plan the due diligence scope. Planning comes before due diligence, contracting, monitoring and termination, because the risk assessment determines the depth of every later lifecycle stage.
- ANegotiating termination and exit provisions in the final contract
- BAssessing the strategic rationale and inherent risk of the arrangement and planning the due diligence scopeCorrect
- CSetting up ongoing quarterly performance monitoring of the vendor
- DExecuting the vendor's transition and decommissioning plan
Explanation
The lifecycle begins with planning: determining why the activity is outsourced, how risky it is, and what due diligence is needed. Contract negotiation, monitoring and termination follow in that order. Monitoring cannot be designed meaningfully before the risk is understood.
Did you get it right without looking?
One question tells you little. A timed set on Case Study: Third-party Risk Management shows your real accuracy, how long you take and where you lose marks.
More Case Study: Third-party Risk Management questions
- A bank uses a scorecard to rank vendors by residual risk. Inherent risk is scored 1-5 and control effectiveness reduces it by a factor: resi…
- A bank's contract with a payment processor sets a service-level target of 99.9% availability over a 30-day month (43,200 minutes). In the mo…
- A mid-sized asset manager is deciding whether to outsource its fund accounting function. Which of the following is the most typical strategi…
- A bank's board wants to reduce cloud concentration risk for a critical payment service. The service must resume within 2 hours of a provider…
- A bank sets an impact tolerance of 8 hours maximum disruption for a critical payments service. A scenario test of a vendor failure shows: ve…
- A bank's board is reviewing its third-party risk framework. Which of the following is the most appropriate responsibility for the board itse…