FRM Part II · FRM Exam Part II · Guidance on Managing Outsourcing Risk
A risk manager designs management reporting on a bank's critical outsourcing arrangements for the board. Which approach is most consistent with good practice?
Good practice is regular board and senior management reporting on critical providers covering key risk indicators, incidents, service level performance and concentration, with clear escalation of exceptions. Vendor lists, breach-only reports or provider-controlled reporting do not give timely, independent insight.
- AProvide only an annual list of all vendors and contract values
- BReport only when a provider breaches its contract
- CProvide periodic summaries of key risk indicators, incidents, SLA performance and concentration for critical providers, with escalation of exceptionsCorrect
- DDelegate all reporting to the provider's own relationship managers
Explanation
Effective oversight needs regular, risk-focused information on critical providers, including KRIs, incidents, performance and concentration, with escalation triggers. A static list, breach-only reporting, or provider-controlled reporting lacks timeliness or independence.
Did you get it right without looking?
One question tells you little. A timed set on Guidance on Managing Outsourcing Risk shows your real accuracy, how long you take and where you lose marks.
More Guidance on Managing Outsourcing Risk questions
- Which item is most appropriately the responsibility of the board, rather than of operational vendor managers, in an outsourcing framework?
- After a provider of a bank's critical cloud services suffers a prolonged outage, the board asks what senior management should have establish…
- A regional bank outsources its payment processing to a single cloud-based provider. The board asks why an exit strategy must be documented b…
- A bank's critical outsourced claims-processing service has a maximum tolerable downtime of 8 hours. The vendor's own business continuity pla…
- A bank's senior management proposes outsourcing its loan-servicing platform to a single vendor. Which action by senior management best fulfi…
- A bank's risk committee is designing its service provider risk management program. Which element would be MOST consistent with supervisory g…