FRM Part II · FRM Exam Part II · Case Study: Third-party Risk Management
After a vendor failure disrupted its trade settlement service, a bank's board wants to define its operational resilience tolerance for that service. Which approach is most consistent with sound operational resilience practice?
The bank should set a maximum tolerable disruption for each critical service, meaning the longest outage it can accept before causing intolerable harm, and then test its ability to remain within it. Accountability stays with the bank's board, and zero-incident targets or loss budgets alone do not capture this.
- ASet the maximum tolerable disruption for the critical service, such as the longest outage acceptable before intolerable harm occurs, and test against itCorrect
- BSet a target of zero incidents across all vendors and services
- CDefine tolerance only by the annual operational loss budget in monetary terms
- DDelegate the tolerance to the vendor, since it operates the service
Explanation
Resilience practice identifies critical operations and sets impact tolerances, the maximum disruption acceptable, then tests the ability to stay within them. Zero incidents is unrealistic, a loss budget ignores customer and market harm, and accountability cannot be delegated to the vendor.
Did you get it right without looking?
One question tells you little. A timed set on Case Study: Third-party Risk Management shows your real accuracy, how long you take and where you lose marks.
More Case Study: Third-party Risk Management questions
- A bank assesses 10 critical applications. Cloud Provider A hosts 4, Provider B hosts 3, Provider C hosts 2 and Provider D hosts 1. Using the…
- During ongoing monitoring, a bank notes that a critical cloud provider has begun subcontracting its data-hosting to a fourth party in anothe…
- A bank uses a scorecard to rank vendors by residual risk. Inherent risk is scored 1-5 and control effectiveness reduces it by a factor: resi…
- A bank's risk team is classifying its vendors. Vendor X supplies office stationery. Vendor Y hosts the bank's real-time payments platform, w…
- A mid-sized asset manager is deciding whether to outsource its fund accounting function. Which of the following is the most typical strategi…
- A bank sets an impact tolerance of 8 hours maximum disruption for a critical payments service. A scenario test of a vendor failure shows: ve…