Skip to content

FRM Part II · FRM Exam Part II · Guidance on Managing Outsourcing Risk

After a provider of a bank's critical cloud services suffers a prolonged outage, the board asks what senior management should have established beforehand to meet its responsibilities. Which is the most appropriate item?

Senior management should have put in place a tested contingency and exit plan so the bank can maintain critical services or move them to another provider or in-house. Contractual liability alone cannot restore operations or protect customers, so resilience planning is required.

  1. AA contingency and exit plan, tested periodically, enabling the bank to continue critical services or move them in-house or to another providerCorrect
  2. BA clause making the provider liable for all reputational damage, removing the need for further planning
  3. CA policy prohibiting any reporting of outages to customers
  4. DA commitment to reduce the audit scope for critical providers

Explanation

Management must ensure business continuity and exit strategies exist for material outsourcing and are tested. Liability clauses cannot restore service or reputation, and suppressing disclosure or reducing audit scope weakens control.

Did you get it right without looking?

One question tells you little. A timed set on Guidance on Managing Outsourcing Risk shows your real accuracy, how long you take and where you lose marks.

Practise Guidance on Managing Outsourcing RiskFree diagnostic mock

More Guidance on Managing Outsourcing Risk questions