<img src="https://ws.zoominfo.com/pixel/pIUYSip8PKsGpxhxzC1V" width="1" height="1" style="display: none;">

Is Your Vendor Prepared for Disaster?

author Michael Berman
3 min read
Sep 22, 2020

The FDIC Office of Inspector General’s (OIG) deep dive into the state of vendor management has revealed widespread deficiencies including business continuity planning, vendor management, contract management, internal controls and cybersecurity. This is the first of five-part blog series that looks at the report's findings. 

Part 1: Business Continuity Planning

The only thing worse than having a critical system go down is having a critical system go down and having no idea when and in what condition it will come back up.

Many pages of regulatory guidance have been written to guard against this situation, yet a recent analysis conducted by the FDIC’s Office of Inspector General finds that just half of vendor contracts it reviewed “explicitly included business continuity provisions.”

When a financial institution (FI) outsources to a third-party vendor, it’s responsible for ensuring the vendor has a business continuity plan to promptly recover and resume operations in the event of a disruption. These plans include a business impact analysis, a risk assessment, risk management, and risk monitoring and testing, the OIG notes.

Related: Podcast: Talking Business Continuity Management & Crisis Communications with ABA

This can only be done effectively when the FI can “coordinate its risk management processes with the service provider’s operations and plans.” Unfortunately, most contracts don’t include the level of detail necessary to make this happen. In fact, nearly half don’t even require vendors to have a business continuity plan.

Gaping holes

Even when they do require plans, they rarely include enough detail to be effective. For instance, the contracts the OIG reviewed didn’t detail vendor responsibilities for critical areas like ongoing risk management, potential events, internal and external dependencies or how they’d service all its clients in the event of a disaster. In the worst cases, vendor contracts actually limited a vendor’s responsibilities if a vendor struck.

Even if a vendor was fully prepared to deal with a disaster, FIs have no way to prove it. An astounding 44 percent of contracts didn’t address auditing or reporting. Those FIs have controls for monitoring vendors or testing their performance. They have no way of knowing if vendors are living up to regulatory or institutional requirements. Their business continuity plans aren’t plans. It’s just hope..

Then there’s the fact that not all reports are the same. Many vendors offer to provide SOC reports, but a contract that requires SOC reports can still fall short of the mark if the vendor turns over low-level SOC-1 reports that focus on “financial statement controls.” SOC-2 or SOC-3 reports, which offer insights into security, processing and data confidentiality controls, are far more valuable, but vendors are far less likely to provide them unless contractually specified.

 

Related: Vendor Risk Countdown: Top 10 Risks Third-Party Vendors Pose to Your Financial Institution

Defining failure

What is a critical system failure and how long should it take to recover from one? That’s a question essentially left up to the vendor in 80 percent of contracts because they don’t include performance standards. Even in the rare cases where performance is defined, there’s often no mention of how a vendor would remedy the situation, including timeframes for recovery.

Even if it weren’t a regulatory requirement, every financial institution should be aware of critical vendor’s business continuity planning efforts. Well-written contracts define key business continuity terms, require evidence of ongoing business continuity planning and detail performance standards. It’s the only way to know your financial institution will be able to recover from unexpected disruptions.

Wondering how risk affects your ability to continue business as usual when disaster strikes? Ncontinuity is the flexible, user-focused business continuity planning (BCP) solution for your organization. With our interactive dashboard and tools, you’ll be assured of business continuity resiliency throughout your institution and in your third-party vendor relationships. Ncontinuity works with our cybersecurity, risk management and vendor management solutions, creating comprehensive risk management for your organization.

 

Learn how Business Continuity Management software can help you.

Subscribe to the Nsight Blog

All Topics Risk & Compliance Product Insight Banks Lending Compliance Credit Unions Risk Management Fair Lending Nfairlending Cluster: Risk Management Compliance Lending Compliance Management Integrated Risk Blog Regulatory Compliance Management Nrisk News & Updates HMDA Risk Mortgage Lenders Vendor Management Ncomply Business Resiliency CRA Lending Compliance Blog Vendor CFPB Ncontinuity Business Continuity Third-Party Vendor Management Cybersecurity Fintech NVendor Strategic Planning Ncyber Regulatory Updates Ntransmittal Audits & Findings OCC Regulatory Compliance Company Culture Audit Nverify Compliance Management Exams FDIC Nfindings Findings NCUA Contract Management Employee Intranet Business Continuity Management Contract FRB Findings Management Enterprise Risk Management FFIEC Ncontracts manager Third-Party Vendors Vendor Risk Vendor Risk Management Wealth Management 1071 ABA Bank Access Control Artificial Intelligence Audit Findings Board Portal Call Report Compliance Risk Cybersecurity Assessment Digital Tansformation Due Diligence Efficiency Employee Engagement Exam findings FIEC Governance and Risk Management Inc. 5000 Internal Audit Management Mortgage Lending Nboardportal Verify integrated risk management
Warning Ahead: Many Vendor Contracts Are Missing Essential Internal Controls
Banks

Warning Ahead: Many Vendor Contracts Are Missing Essential Internal Controls

Mar 30, 2017 2 min read
3 Take-aways from the OCC Third-Party Vendors Relationship FAQ
Banks

3 Take-aways from the OCC Third-Party Vendors Relationship FAQ

Mar 10, 2020 3 min read
Vendor Management: Which ‘Friend’ Will Be There for You?
Banks

Vendor Management: Which ‘Friend’ Will Be There for You?

May 27, 2021 4 min read