Due diligence checklist, United States
Interagency TPRM Guidance: what to ask a vendor
Interagency Guidance on Third-Party Relationships: Risk Management (OCC, Federal Reserve, FDIC). OCC, Federal Reserve and FDIC. Risk-based oversight of third parties from planning and due diligence to contract, monitoring and exit.
What it is
Risk-based oversight of third parties from planning and due diligence to contract, monitoring and exit.
Who it applies to
Applies to every financial institution in the United States.
What to ask a vendor, and the evidence to request
| # | Ask the vendor for | Evidence to request |
|---|---|---|
| 1 | A due diligence pack: financial condition, SOC reports, business continuity and subcontractors | The business continuity and disaster recovery plans for the service, the stated recovery time and recovery point objectives, and the report from the last test with its date and outcome. |
| 2 | Contract provisions on performance measures, audit rights, confidentiality, incident notice and termination | The incident notification clause and procedure: what counts as an incident, who is told, within what time, and a record of a past notification if one exists. |
| 3 | Ongoing performance and risk reporting the institution can monitor against | A description of the reports the system produces for the regulator, the formats, and how they are lodged, with a sample. |
In every case
- A named contact at the vendor responsible for this regime, and how the vendor tracks changes to it.
- Which named customers the vendor already serves under this regime, as references you may call.
This checklist is a starting point for a procurement team, not legal advice. Read it with the regulator's own page, your institution's policies and your legal and risk teams; the regime may have changed since the date on this document.
Next
- Every checklist, by country
- What a market scan is and how to run one
- Have Vederca run the procurement: the regime goes into the register as a must-have