Skip to content

ACCA Strategic Professional · Strategic Business Leader · Managing, monitoring and mitigating risk

Orlan Pharma plans to outsource its clinical trial data processing to a specialist firm, reasoning that this will 'transfer' the risk of data breaches. The contract limits the supplier's liability to the fees paid. Which conclusion best reflects TARA and sound risk governance?

Only part of the financial exposure is transferred, and only up to the supplier's liability cap. Orlan keeps legal, regulatory and reputational accountability for data breaches, so the board must retain oversight, monitor the supplier and manage the residual risk on its register rather than treating the risk as removed.

  1. AThe risk is fully transferred, so the board can remove it from the register
  2. BOnly the contractual, financial element is partly transferred; legal, regulatory and reputational accountability remain with Orlan, so it must retain oversight and residual risk monitoringCorrect
  3. CThe action is Avoid because the activity is now performed externally
  4. DThe action is Accept because the supplier cap prevents any recovery

Explanation

Outsourcing with a liability cap transfers only a limited financial portion. Regulatory liability, patient trust and reputation stay with Orlan, and the board remains accountable. It must therefore keep the risk on the register, monitor the supplier and manage the residual exposure. The activity continues, so it is not Avoid.

Did you get it right without looking?

One question tells you little. A timed set on Managing, monitoring and mitigating risk shows your real accuracy, how long you take and where you lose marks.

Practise Managing, monitoring and mitigating riskFree diagnostic mock

More Managing, monitoring and mitigating risk questions