Due diligence checklist, Canada
OSFI E-21: what to ask a vendor
Guideline E-21 Operational Risk Management and Resilience. OSFI. Critical operations, and the third parties behind them, stay within tolerance for disruption.
What it is
Critical operations, and the third parties behind them, stay within tolerance for disruption.
Who it applies to
Applies to banks, mutuals and credit unions, insurers and pension and superannuation funds in Canada.
What to ask a vendor, and the evidence to request
| # | Ask the vendor for | Evidence to request |
|---|---|---|
| 1 | Recovery objectives that fit the institution's tolerances for its critical operations | The business continuity and disaster recovery plans for the service, the stated recovery time and recovery point objectives, and the report from the last test with its date and outcome. |
| 2 | Participation in scenario testing and business continuity exercises | The business continuity and disaster recovery plans for the service, the stated recovery time and recovery point objectives, and the report from the last test with its date and outcome. |
In every case
- A named contact at the vendor responsible for this regime, and how the vendor tracks changes to it.
- Which named customers the vendor already serves under this regime, as references you may call.
This checklist is a starting point for a procurement team, not legal advice. Read it with the regulator's own page, your institution's policies and your legal and risk teams; the regime may have changed since the date on this document.
Next
- Every checklist, by country
- What a market scan is and how to run one
- Have Vederca run the procurement: the regime goes into the register as a must-have