Skip to content

FRM Part II · FRM Exam Part II · Case Study: Third-party Risk Management

A regional bank uses a single cloud provider to host its core banking, payments and fraud-detection systems. Which description best captures the principal concentration risk this arrangement creates?

The main concentration risk is that one provider outage or failure could disrupt several critical services at once, because core banking, payments and fraud detection all depend on the same vendor. Regulatory accountability stays with the bank and cannot be transferred to the provider.

  1. AA single provider outage or failure could disrupt several critical services simultaneouslyCorrect
  2. BThe bank loses the ability to negotiate any service-level agreement
  3. CThe cloud provider becomes legally responsible for the bank's regulatory compliance
  4. DThe bank's credit risk on its loan book rises automatically

Explanation

Concentration risk arises when many critical functions depend on one provider, so one failure produces correlated disruption. Accountability for regulatory compliance stays with the bank, so the second-best-sounding option on legal responsibility is wrong. Loan credit risk is unrelated.

Did you get it right without looking?

One question tells you little. A timed set on Case Study: Third-party Risk Management shows your real accuracy, how long you take and where you lose marks.

Practise Case Study: Third-party Risk ManagementFree diagnostic mock

More Case Study: Third-party Risk Management questions