Charta is on Google Play: practise on the go. Get the app
Charta

Characterise how risks from interconnected third-party service providers are governed in practice.

FRM® Part II · Operational Risk and Resilience · Cyber-resilience: Range of practices · FRM2.ORR.8.e

The idea

Banks depend on cloud, software, data-centre and payment providers, so cyber-resilience must extend beyond the institution. The core principle is that outsourcing does not transfer accountability. The institution remains responsible for the risk and for meeting supervisory expectations. Practice therefore includes risk-based tiering of providers by criticality, security due diligence and contracts with security requirements. It also includes incident notification, audit and access rights for the institution and its supervisor, and exit and substitution plans. Governance must also cover fourth parties, the subcontractors on which a provider relies, through disclosure and flow-down of requirements. Concentration risk arises when many institutions, or many of one institution's services, depend on the same provider or hidden upstream dependency, so one failure spreads widely. Authorities mainly hold regulated institutions to account, and some can examine critical providers directly. Exam point: criticality and access, not contract size, drive the tier.

A practice question

From the question bank, with the reason each wrong option is wrong.

When a bank outsources a critical function to a cloud provider, where does accountability for the associated cyber risk lie?

  1. With the bank, which remains responsible even though the provider performs the service - correct
  2. With the cloud provider, because the contract transfers all responsibility to itWhy not: Contracts allocate duties but do not remove the institution's accountability to its customers and supervisor.
  3. With the supervisor, which must approve every outsourcing arrangementWhy not: Supervisors oversee but are not accountable for the bank's risk; approval is not the transfer of responsibility.
  4. With the bank's insurer, once a cyber policy is in forceWhy not: Insurance transfers some financial loss but not accountability or operational responsibility.

Outsourcing delegates the activity, not the accountability. The bank must still manage the risk and meet supervisory expectations.

A harder one

A bank negotiates a contract for hosting its core banking platform. Which provision best supports cyber-resilience?

  1. Reliance on the provider's annual certification, with no audit or access right for the bank or its supervisorWhy not: Certifications help but removing all audit and access rights leaves the bank unable to verify or evidence control.
  2. Defined security requirements, prompt incident notification, audit and access rights for the bank and its supervisor, and support for orderly exit - correct
  3. Notification of incidents only at the provider's discretionWhy not: Without a defined timeline the bank may not learn of an incident in time to respond or report.
  4. Freedom for the provider to change subcontractors without any noticeWhy not: Hides fourth-party changes, so the bank cannot assess or govern new dependencies.

Good contracts set security requirements, require timely incident notice, give audit and access rights and provide for exit. Discretionary notice, certification-only assurance or silent subcontracting weaken oversight.

The hardest tier

A bank splits a critical workload between two cloud providers to reduce concentration risk. It later learns both providers rely on the same upstream identity and DNS service. Which concept does this illustrate, and what governance step does it call for?

  1. Fourth-party concentration, calling for mapping of subcontractor dependencies - correct
  2. Vendor sprawl, which calls for consolidating onto a single providerWhy not: The issue is shared upstream dependency, not too many vendors; consolidation would raise concentration.
  3. Provider insolvency risk, which calls for demanding higher capital from the providersWhy not: Nothing suggests financial weakness; the shared dependence is operational and technical.
  4. Data localisation risk, which calls for moving all workloads on-premises immediatelyWhy not: Not the described problem; moving everything in-house is an overreaction and forgoes the benefits of managed services.

Two apparently separate providers sharing the same upstream service still create a single point of failure. Governance requires visibility into subcontractors through disclosure, mapping and flow-down of requirements.

In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.

Start free →

More in Cyber-resilience: Range of practices