Question

A financial services firm decides to transfer the risk of a specialized fraud-detection process by outsourcing it to a third-party provider under contract. Six months later, the provider suffers a prolonged outage, and the firm is unable to process transactions, resulting in regulatory penalties and customer losses. Senior management is surprised, believing the risk had been fully removed. What is the MOST important lesson the risk practitioner should communicate to management about this outcome?

Accepted Answer

Risk transfer does not eliminate accountability; the firm retains ownership of the risk and must monitor residual and secondary risks introduced by the provider.

Answer

Transferring a risk to a third party shifts accountability for that risk to the provider, so the firm bears no further responsibility.

Answer

Outsourcing was the wrong response; the risk should have been avoided by discontinuing the fraud-detection process entirely.

Answer

The regulatory penalties prove the risk assessment was flawed and the entire risk register must be recalculated using quantitative methods.