Downloaded 17 times
Uploaded byGary Hess
Vendor due diligence
This document discusses vendor due diligence requirements for credit unions. It covers the NCUA's expectations for supervisory committees and directors to establish practices to safeguard member assets when working with vendors. The document outlines key areas of due diligence including assessing risks and benefits, financial reviews, background checks, contracts, and ongoing monitoring. It identifies the top five vendor categories of IT, indirect lending, mortgages, cloud computing, and loan participations. Guidance documents are referenced and checklists are provided to help management evaluate current vendors and processes.
Vendor due diligence
- 1. Vendor Due Diligence Supervisory Committee and Director’s Conference January 2013 www.rtefs.com
- 2. September 15, 2011 Walkingback from lunch at the Lake Calhoun Beach Club www.rtefs.com
- 3. Target Field The summerwe do not tell anyone about. www.rtefs.com
- 4. AGENDA • Ripped fromthe Headlines – Important not only because the regulators say so. • Responsibility • Vendor Due Diligence – General Requirements • Vendor Due Diligence – Specific Areas • The Top Five • Forms and Guidance • Credit Union and Member Benefits www.rtefs.com
- 5.
- 6.
- 7.
- 8.
- 9. WHAT IS AVENDOR? www.rtefs.com
- 10. What is aVendor? • IT • Social Media – Facebook, LinkedIn, • Internet Provider etc. • Indirect Lending • Accounting and Legal • Application Provider firms • Maintenance firms • Third Party Contractors • Cloud Computing - GMail www.rtefs.com
- 11. Responsibility • NCUA Part715.3 General Responsibilities of the Supervisory Committee • Supervisory Letter 07-01 October 2007 www.rtefs.com
- 12. NCUA Part 715.3 •(a)(2) Establish practices and procedures sufficient to safeguard members' assets. • (b)(4) Policies and control procedures are sufficient to safeguard against error, conflict of interest, self-dealing and fraud. www.rtefs.com
- 13. Supervisory Letter 07-01 •Credit unions must complete the due diligence necessary to ensure the risks undertaken in a third party relationship are acceptable in relation to their risk profile and safety and soundness requirements. www.rtefs.com
- 14. Supervisory Letter 07-01 •What is your risk profile? • What are your safety and soundness requirements? www.rtefs.com
- 15. Supervisory Letter • RiskAssessment and Planning Risks and benefits of outsourcing vs. internal operation • Financial Projections www.rtefs.com
- 16. Supervisory Letter • DueDiligence Background check Business plan/model Cash Flows Financial and Operational Control Review Contract and Legal Review Accounting Considerations www.rtefs.com
- 17. Supervisory Letter • RiskMeasurement, Monitoring and Control of Third Party Relationships Policies and Procedures Risk Measuring and Monitoring Control System and Reporting www.rtefs.com
- 18. Top Five • IT •Indirect Lending • Mortgage • Cloud Computing Platform Products, Social Media, etc. • Loan Participations www.rtefs.com
- 19. Top Five • IT •NCUA Exam Guide – Information Systems and Technology www.rtefs.com
- 20. Top Five • IndirectLending • Letter to Credit Unions 10 – CU - 15 www.rtefs.com
- 21. Top Five • Mortgage www.rtefs.com
- 22. Top Five • CloudComputing • FFIEC Cloud Computing Statement http://ithandbook.ffiec.gov/media/153119/06-28-12_- _external_cloud_computing_-_public_statement.pdf www.rtefs.com
- 23. Top Five • LoanParticipations • Letter to Credit Unions 08 – CU – 26 Supervisory Letter Attached to Letter Examiner Guide Attached to Letter www.rtefs.com
- 24. GUIDANCE www.rtefs.com
- 25. Guidance • Letter toCredit Unions 01 – CU – 20 • Letter to Credit Unions 07 – CU - 13 • Letter to Credit Unions 10 – CU – 26 • Examiner’s Guide – Information Systems and Technology http://www.ncua.gov/Legal/GuidesEtc/ExaminerGuide/ Chapter06.pdf www.rtefs.com
- 26. Checklist for Management •Request a list of vendors that the credit union has today. • Request a statement on the due diligence performed today on vendors. • Compare against what you have learned here. • Do the policies and procedures need to be updated? www.rtefs.com
- 27. Checklist for Management •Alert all areas of the credit union you require a report on any new vendors • Prepare a list of questions for the report: Vendor Name Vendor function Due Diligence performed Issues in due diligence assessment Recommendation www.rtefs.com
- 28. The Future • FinCENANPR on enhanced Customer Due Diligence (CDD) – March 2012 • Do we think this is the last we will hear of Vendor Due Diligence?? www.rtefs.com
- 29. Questions?? www.rtefs.com
- 30. Resources • IT DueDiligence Guide – Checklist • FFIEC IT Handbook and Guidelines www.rtefs.com
- 31. THANK YOU • Gary Hess • President, RTE Financial Services • 1-320-260-0135 • Gary.hess@rtefs.com • www.rtefs.com www.rtefs.com