Skip to content

FRM Part II · FRM Exam Part II · Risk Mitigation

During due diligence on a prospective cloud service provider, which finding should most concern a bank's risk committee when the service supports a critical function?

A refusal to grant audit and access rights to the bank and its supervisor is the biggest concern. Without those rights the bank cannot verify controls or meet its oversight duties for a critical function, so it cannot manage the outsourcing risk adequately.

  1. AThe provider charges a premium price compared with competitors
  2. BThe provider refuses to grant the bank and its supervisor audit and access rightsCorrect
  3. CThe provider uses a standardised service-level reporting template
  4. DThe provider has been operating for more than ten years

Explanation

For critical functions, the bank and its regulators must be able to audit and access information about the service. A refusal prevents effective oversight and is a fundamental weakness. Price, standardised reporting and long history are not control deficiencies.

Did you get it right without looking?

One question tells you little. A timed set on Risk Mitigation shows your real accuracy, how long you take and where you lose marks.

Practise Risk MitigationFree diagnostic mock

More Risk Mitigation questions