<img src="https://ws.zoominfo.com/pixel/pIUYSip8PKsGpxhxzC1V" width="1" height="1" style="display: none;">

Does Your Vendor Management Program Measure Up to the DOJ Expectations?

author Michael Berman
2 min read
Jun 29, 2020

Every financial institution knows that regulatory agencies evaluate a FI’s vendor management program as part of the exam process. But did you know the Department of Justice is interested in it too?

When deciding whether to bring charges, negotiate plea agreements, or calculate criminal fines, the DOJ considers a company’s compliance program, including its vendor management program. The department is particularly interested in whether the program can “detect the particular types of misconduct most likely to occur in a particular corporation’s line of business.”

What is the DOJ Looking for in a Vendor Management Program?

In its most recent guidance “Evaluation of Corporate Compliance Programs,” the DOJ mentions four elements it assesses when looking at a vendor management program:

  1. Risk-based and integrated. When it comes to assessing plans, the DOJ recognizes compliance programs vary based on factors like size and geography. It expects the same of vendor management and assesses how vendor management processes correspond with identified risks.
  2. Controls. The DOJ wants documentation demonstrating why a company decided to outsource. If a third-party vendor was involved in the reason for the investigation, the DOJ will want to know why the vendor was selected, that it was vetted for reputation, and that the contract clearly describes services to perform and appropriate payment terms. There should be mechanisms to show work was performed and compensation is reasonable.
  3. Monitoring. The DOJ will look at how vendors are monitored, whether the company has audit rights and whether they use them, how the vendor conducts compliance training, and incentivizes compliance. It also will see if due diligence occurs only at the beginning or if it is ongoing throughout the relationship.
  4. Accountability. The DOJ will assess whether a company notes a red flag in vendor behavior and how it addresses the issue when it happens. It expects there to be consequences.

The good news for financial institutions is that a good vendor management program should already address these elements. The main difference between financial regulators and the DOJ, is the DOJ’s focus on misconduct. While financial regulators are concerned about a broad range of concerns related to the safety and soundness of the institution, including operational risk and business continuity, the DOJ cares about crime.

For example, the DOJ looks for “an understanding of the qualifications and associations of third-party partners, including the agents, consultants, and distributors that are commonly used to conceal misconduct, such as the payment of bribes to foreign officials in international business transactions.”

Does your vendor due diligence process have controls for detecting vendor malfeasance? If not, you may want to consider adding them. With luck on your side, you’ll never have to deal with the Justice Department—but it’s always a good idea to be prepared.

Subscribe to the Nsight Blog

All Topics Risk & Compliance Product Insight Banks Lending Compliance Credit Unions Risk Management Fair Lending Nfairlending Cluster: Risk Management Compliance Lending Compliance Management Integrated Risk Blog Regulatory Compliance Management Nrisk News & Updates HMDA Risk Mortgage Lenders Vendor Management Ncomply CRA Business Resiliency Lending Compliance Blog Vendor CFPB Ncontinuity Business Continuity Third-Party Vendor Management Cybersecurity Fintech NVendor Strategic Planning Ncyber Regulatory Updates Ntransmittal Audits & Findings OCC Regulatory Compliance Company Culture Audit Nverify Compliance Management Exams FDIC Nfindings Findings NCUA Contract Management Employee Intranet Business Continuity Management Contract FRB Findings Management Enterprise Risk Management FFIEC Ncontracts manager Third-Party Vendors Vendor Risk Vendor Risk Management Wealth Management 1071 ABA Bank Access Control Artificial Intelligence Audit Findings Board Portal Call Report Compliance Risk Cybersecurity Assessment Digital Tansformation Due Diligence Efficiency Employee Engagement Exam findings FIEC Governance and Risk Management Inc. 5000 Internal Audit Management Nboardportal Verify integrated risk management
Are Vendors Your Biggest Obstacle to Fintech Adoption? It Might Not Be Their Fault
Banks

Are Vendors Your Biggest Obstacle to Fintech Adoption? It Might Not Be Their Fault

Jan 23, 2020 2 min read
What to Do When You’re Worried About Your Vendor’s Finances
Banks

What to Do When You’re Worried About Your Vendor’s Finances

Jun 12, 2019 2 min read
Vendor Due Diligence: Don't Make This SOC 2 Report Mistake
Banks

Vendor Due Diligence: Don't Make This SOC 2 Report Mistake

Aug 4, 2020 5 min read