FRM Part II · FRM Exam Part II · Case Study: Third-party Risk Management
Following a third-party outage, a bank reviews its exit planning for a critical outsourced service. Which element is most important for the exit plan to be credible?
A credible exit plan needs a tested ability to move the critical service to an alternative provider or in-house within the impact tolerance. Compensation clauses, cheaper renewals or statements that exit is unlikely do not restore service, so they do not make the plan workable.
- ATested ability to transfer the service to an alternative provider or bring it in-house within the impact toleranceCorrect
- BA clause stating that the vendor will compensate the bank for all losses
- CAnnual renewal of the contract at a lower price
- DA policy statement that exit is unlikely to be needed
Explanation
A credible exit plan must be workable and tested so the service can move to another provider or in-house within tolerance. Compensation clauses do not restore the service, price renewals are commercial, and a statement of unlikelihood is not a plan.
Did you get it right without looking?
One question tells you little. A timed set on Case Study: Third-party Risk Management shows your real accuracy, how long you take and where you lose marks.
More Case Study: Third-party Risk Management questions
- A mid-sized bank relies on a single cloud provider to host its payments platform, core ledger and customer authentication service. The risk …
- A risk officer reviews a bank's outsourcing register and finds that the contract with a critical cloud provider lacks an exit strategy and a…
- Before signing a contract with a prospective provider of loan-servicing, which activity should a bank's third-party risk framework place fir…
- A mid-sized bank relies on a single cloud provider to host its payment processing platform. The provider suffers a multi-day outage, and the…
- A bank discovers that its critical vendor outsources part of the service to a subcontractor, which then fails. The bank had only assessed th…
- A bank wants to reduce the risk that a single cloud provider outage disrupts a critical service with a short impact tolerance. Which action …