Skip to content

FRM Part II · FRM Exam Part II · Guidance on Managing Outsourcing Risk

Meridian Bank is evaluating two vendors for a critical payments-processing service. Which action best reflects sound due diligence BEFORE selecting a vendor?

Sound due diligence evaluates each vendor's financial condition, operational capability, security controls, continuity planning and reputation, with depth scaled to how critical the service is. Relying on price, indemnities, marketing material or vendor self-assessment fails to give the bank independent assurance.

  1. ASelecting the lowest-cost vendor and relying on the contract's indemnity clause to cover any failure
  2. BAssessing each vendor's financial condition, operational capability, security controls, business continuity plans and reputation, with depth proportionate to the activity's criticalityCorrect
  3. CReviewing only the vendor's marketing materials and customer references, since audits are performed after onboarding
  4. DDelegating due diligence to the vendor's own compliance team and accepting its self-assessment

Explanation

Due diligence should be risk-based and cover financial strength, operational and security capabilities, resilience and reputation, scaled to criticality. Indemnities do not remove the bank's responsibility, and self-assessment alone lacks independence.

Did you get it right without looking?

One question tells you little. A timed set on Guidance on Managing Outsourcing Risk shows your real accuracy, how long you take and where you lose marks.

Practise Guidance on Managing Outsourcing RiskFree diagnostic mock

More Guidance on Managing Outsourcing Risk questions