Due diligence checklist, United States
FFIEC IT Examination Handbook: what to ask a vendor
FFIEC IT Examination Handbook: Outsourcing Technology Services and Business Continuity Management. FFIEC. Outsourced technology stays within the examiners' reach, with continuity planning tested.
What it is
Outsourced technology stays within the examiners' reach, with continuity planning tested.
Who it applies to
Applies to banks and mutuals and credit unions in the United States.
What to ask a vendor, and the evidence to request
| # | Ask the vendor for | Evidence to request |
|---|---|---|
| 1 | Examiner access to the service and its records | The contract clause giving the institution and its regulator access, audit and information rights, and the vendor's process for an audit request. |
| 2 | Business continuity testing with results the institution can review | The business continuity and disaster recovery plans for the service, the stated recovery time and recovery point objectives, and the report from the last test with its date and outcome. |
| 3 | Independent audit reports (SOC 1 and SOC 2) on the service | The contract clause giving the institution and its regulator access, audit and information rights, and the vendor's process for an audit request. |
In every case
- A named contact at the vendor responsible for this regime, and how the vendor tracks changes to it.
- Which named customers the vendor already serves under this regime, as references you may call.
This checklist is a starting point for a procurement team, not legal advice. Read it with the regulator's own page, your institution's policies and your legal and risk teams; the regime may have changed since the date on this document.
Next
- Every checklist, by country
- What a market scan is and how to run one
- Have Vederca run the procurement: the regime goes into the register as a must-have