medium · FRM Part 2 Operational Risk

A global bank allocates its cloud computing expenditures across three vendors: Provider A (60%), Provider B (30%), and Provider C (10%). Calculate the Herfindahl-Hirschman Index (HHI) for this vendor concentration and identify the primary systemic risk if Provider A is designated as a critical ICT third-party provider (CTPP).

1. HHI equals 0.46; the primary risk is losing competitive pricing leverage over time due to contractual vendor lock-in and switching costs.
2. HHI = 0.46; the primary risk is a systemic single point of failure where a lone provider's outage synchronizes failure across the financial sector.
3. HHI equals 0.36, calculated by squaring only the largest share; the primary risk is an idiosyncratic failure confined to the bank's internal ledger system.
4. HHI equals 1.00, summing the raw percentages rather than their squares; the primary risk is that the bank cannot legally outsource accountability for core processing.

Sign up free to see the explanation and track your rank →