Practical Tips for Vendor Management

Transcription

1 Practical Tips for Vendor Management Karen Louis Atlanta GA May 6 and 8,

2 REGULATORY GUIDANCE Office of the Comptroller of the Currency Oct 2013: Third-Party Relationships, Risk Management Guidance Federal Reserve Dec 2013: Guidance on Managing Outsourcing Risk Consumer Financial Protection Bureau Apr 2012: Service Providers Federal Deposit Insurance Corporation Jun 2008: Guidance for Managing Third-Party Risk 2

3 WHO IS A THIRD PARTY? All entities that have entered into a business relationship with a financial institution ~ FDIC Third-party relationships include activities that involve outsourced products and services, use of independent consultants, networking arrangements, merchant payment processing services, services provided by affiliates and subsidiaries, joint ventures, and other business arrangements where the bank has an ongoing relationship or may have responsibility for the associated records. Third-party relationships generally do not include customer relationships. ~ OCC Service providers is broadly defined to include all entities that have entered into a contractual relationship with a financial institution to provide business functions or activities. Entities may be a bank or nonbank, affiliated or non-affiliated, regulated or non-regulated, or domestic or foreign. ~ FRB Service provider is generally defined in section 1002(26) of the Dodd-Frank Act as any person that provides a material service to a covered person in connection with the offering or provision by such covered person of a consumer financial product or service. (cite omitted) A service provider may or may not be affiliated with the person to which it provides services. ~ CFPB 3

4 FDIC s STATEMENT: An institution s board of directors and senior management are ultimately responsible for managing activities conducted through third-party relationships, and identifying and controlling the risks arising from such relationships, to the same extent as if the activity were handled within the institution. 4

5 4 CORE ELEMENTS Planning / Risk Assessment Due Diligence Contracting Performance Monitoring 5

6 #1: PLAN FOR IDENTIFIED RISKS Consistent with Strategic Plan Identifying Objectives RFP Controls to Match the Risk 6

7 #1: PLAN FOR IDENTIFIED RISKS OCC critical activities FDIC FED significant relationships substantial impact operational compliance reputation strategic & credit CFPB material service 7

8 #1: PLAN FOR IDENTIFIED RISKS OCC critical activities INFORMATION TECHNOLOGY FDIC FED significant relationships substantial impact operational compliance reputation strategic & credit FORECLOSURE EVICTIONS THIRD-PARTY PRODUCTS CFPB material service PAYMENT PROCESSORS 8

9 #2: PERFORM YOUR DUE DILIGENCE Online Searches Lawsuits Customer Complaints Onsite Visits Audited Financials Vendor Certifications Questionnaires Professional References 9

10 #2: PERFORM YOUR DUE DILIGENCE Ocwen Complaint 10

11 #2: PERFORM YOUR DUE DILIGENCE How Extensive Is Your Due Diligence Audited financials Significance of the contract on vendor s financial condition Insurance coverage Use of subcontractors Experience of principals Background checks Maintain records 11

12 #3: GET IT IN WRITING REPRESENTATIONS LICENSING EXPERIENCE COMPLIANCE SUBCONTRACTORS PERMIT/PROHIBIT PRIOR APPROVAL/NOTICE DATA PRIVACY CUSTOMER NON-PUBLIC INFORMATION BANK LOGOS & SYSTEM ACCESS SECURITY BREACH CONTINGENCY CATASTROPHIC EVENTS DATA LOSS LOSS/CHANGE OF SUBCONTRACTORS 12

13 #3: GET IT IN WRITING PERFORMANCE INCORPORATE SLAs, SOWs OTHER STANDARDS COMPENSATION AUDIT RIGHT TO AUDIT, 3 RD PARTY AUDITS RECORDKEEPING REGULATOR ACCESS LIABILITY INDEMNIFICATION PROVISION LIMIT ON BANK S LIABILITY COMPLAINTS HANDLING REPORTING 13

14 #4: MEASURE PERFORMANCE Oversight Responsibility requisite knowledge and skills to critically review all aspects of the relationship Tools to Measure Performance Ongoing monitoring Self-Assessments Scorecards Establish Frequency Annual Semi-Annual Quarterly 14

15 #4: MEASURE PERFORMANCE Performance Benchmarks Financial condition Licensing Significant change in staff or subcontractors Legal compliance Data privacy practices/training Document Issues / Escalate 15

16 BONUS: KNOW WHEN TO CALL IT QUITS Typical Termination Triggers: Poor performance results Negative publicity Significant decline in financial condition Contingency plan Returning records, terminating system access 16

17 THANK YOU KAREN LOUIS (404)