FRM Part II · FRM Exam Part II · Risk Mitigation
During due diligence on a prospective vendor that will handle sensitive customer data, which finding should most strongly prompt the bank to reconsider the engagement or require remediation before signing?
Reliance on undisclosed fourth-party subcontractors in another jurisdiction, with refused audit access, is the most serious finding. It leaves the bank unable to oversee data protection and resilience across the full service chain, so remediation or reconsideration is needed before contracting.
- AThe vendor's headquarters is in a different city from the bank
- BThe vendor relies on undisclosed subcontractors (fourth parties) in another jurisdiction and refuses to allow audit access to themCorrect
- CThe vendor's pricing is higher than that of two competitors
- DThe vendor has been in business for eight years
Explanation
Undisclosed subcontractors with no audit or oversight rights create opaque data-protection, legal and resilience exposures the bank cannot monitor. Location, price and operating history are commercial considerations and not by themselves control deficiencies.
Did you get it right without looking?
One question tells you little. A timed set on Risk Mitigation shows your real accuracy, how long you take and where you lose marks.
More Risk Mitigation questions
- Which testing approach best demonstrates that a firm can actually remain within its impact tolerances for an important business service duri…
- A bank's payments unit identifies that a manual reconciliation step causes frequent errors. Management decides to automate the step and add …
- After a breach investigation, a bank finds that an attacker used stolen credentials of a vendor to move laterally from a low-sensitivity rep…
- During due diligence on a prospective cloud service provider, which finding should most concern a bank's risk committee when the service sup…
- A bank outsources its customer call centre to a vendor under a contract with service-level agreements. After a vendor failure, the bank's cu…
- Which practice best addresses moral hazard that arises once a bank has purchased operational risk insurance?