Financial Risk Manager Part 2

Get started today

Ultimate access to all questions.

Explanation:

To properly manage operational risk and follow the principle of least privilege, a bank should restrict third-party vendor access strictly to what is required for their responsibilities. Since the vendor's role is marketing, they do not need access to the bank's critical processing systems.

Option A is incorrect because comprehensive due diligence requires reviewing private, non-public third-party audit reports (such as SOC 2 reports), rather than relying only on publicly available information.
Option B is incorrect because a compensation structure based primarily on commissions significantly increases conduct risk, creating incentives for mis-selling financial products.
Option D is incorrect because the vendor is responsible for developing and maintaining its own contingency and business continuity plans, although the bank should review and evaluate their adequacy.

Explanation:

Option A is incorrect because comprehensive due diligence requires reviewing private, non-public third-party audit reports (such as SOC 2 reports), rather than relying only on publicly available information.
Option B is incorrect because a compensation structure based primarily on commissions significantly increases conduct risk, creating incentives for mis-selling financial products.
Option D is incorrect because the vendor is responsible for developing and maintaining its own contingency and business continuity plans, although the bank should review and evaluate their adequacy.

Comments (0)

No comments yet.

Question The senior management team of a small regional bank has established a committee to review procedures and implement best practices related to entering into significant contracts with third-party vendors. The committee is reviewing one proposed relationship with a third-party vendor who would have a significant responsibility for marketing the bank's financial products to potential customers. In establishing policies to reduce the operational risk associated with this potential vendor contract, which of the following recommendations would be most appropriate?

Exam-Like

Community

UAnonymous

Last updated: July 5, 2026 at 07:28

The bank should review all third-party audit reports of the vendor, which are publicly available.

The bank should ensure that the vendor's sales representatives are compensated mainly with commissions from the sale of the bank's products.

The bank should prevent the third-party vendor from having access to any of its critical processes.

The bank should be responsible for developing the vendor's contingency planning process to mitigate risk exposure to the vendor.