FRM Part II · FRM Exam Part II · Case Study: Third-party Risk Management
After a vendor failure disrupted a bank's customer onboarding service, the board asks how to define impact tolerance for that important business service. Which definition is most consistent with operational resilience practice?
Impact tolerance is the maximum level of disruption to an important business service that a firm can accept before intolerable harm occurs to customers or market stability. It is a limit on disruption, often a maximum outage time, not an expected loss, capital buffer or default probability.
- AThe maximum level of disruption to a service the firm can accept before intolerable harm results to customers or market stabilityCorrect
- BThe average annual loss the firm expects from operational events
- CThe capital buffer held against third-party losses under the standardized approach
- DThe probability that the vendor will default within one year
Explanation
Impact tolerance sets the limit of disruption, often expressed as maximum duration, that a firm can accept for an important business service before intolerable harm occurs. Expected loss and capital buffers are loss measures and default probability is a credit concept, so none define tolerance.
Did you get it right without looking?
One question tells you little. A timed set on Case Study: Third-party Risk Management shows your real accuracy, how long you take and where you lose marks.
More Case Study: Third-party Risk Management questions
- A regional bank discovers that its payments processing, fraud monitoring and customer onboarding vendors all run their production workloads …
- Which role is the internal audit function expected to perform with respect to a bank's third-party risk management framework?
- A bank outsources its customer onboarding checks to a vendor, which in turn uses a subcontractor in another jurisdiction for document verifi…
- A bank's third-party risk policy requires an exit strategy for critical outsourced services. A regulator reviewing the bank finds that the s…
- A bank's critical service has an impact tolerance of 8 hours. Its vendor contract guarantees recovery within 6 hours, but the vendor depends…
- A bank's second line of defense reviews its third-party risk management. Which arrangement best aligns with the three-lines model for outsou…