<img src="https://ws.zoominfo.com/pixel/pIUYSip8PKsGpxhxzC1V" width="1" height="1" style="display: none;">

The FFIEC Brings the Board to the Block

author Michael Berman
1 min read
Nov 18, 2015

With the FFIEC’s November 2015 release of the organization’s IT Technology Examination Handbook, many financial institutions’ board members get a big surprise.

In section I.A.1 Board of Directors Oversight, under I.A – IT Governance, it requires FI boards of directors to take a more active role in understanding and managing their financial institution’s IT vendors, strategy, and risks. In fact, the board will be held responsible for reviewing third-party IT service provider (ISP) strategic planning and ensuring it is in alignment with the institution’s overall business strategy, participating in ISP risk assessments, and the oversight of the information security and resilience against cyber-threats of their ISPs. The board is now part of the approval process too.

Here are additional accountabilities FI boards are now required to share with their management teams:

  • Active promotion of the institution’s IT governance
  • Approval of critical IT projects and the expansion of mobile products
  • Oversight of feasibility studies surrounding the financial, security, and business continuity soundness of ISPs
  • Determine the adequacy and allocation of IT resources and the funding of implementation
  • Holding internal business units accountable for identifying and measuring impacts of risks, and providing guidance on the mitigation of those risks
  • Requiring and reviewing reports and analyses from all IT business units
  • Provide comprehensive, independent audits of IT controls

Boards may elect to create steering committees to manage the FFIEC’s new stipulations for their involvement in their FI’s IT vendor management process, but this solution is not always a viable option for smaller organizations. As such, the board or board committee, management, and IT personnel are responsible for taking ownership over the tasks at hand and others listed in the governance.

Keep in mind, though, you are not alone. On December 10th 2015, we are presenting a vendor management webinar designed to show you how to address the FFIEC mandates and mitigate risk in your vendor relationships. You will learn a proven methodology that conserves valuable resources and alleviates unnecessary stress regulations place on all business units across your financial organization.

30 minutes of your time can make a difference in taking control of your vendor management process, secure your regulatory compliance, and provide auditors and examiners with the reports they require.

Subscribe to the Nsight Blog

All Topics Risk & Compliance Product Insight Banks Lending Compliance Credit Unions Risk Management Fair Lending Nfairlending Cluster: Risk Management Compliance Lending Compliance Management Integrated Risk Blog Regulatory Compliance Management Nrisk News & Updates HMDA Risk Mortgage Lenders Vendor Management Ncomply Business Resiliency CRA Lending Compliance Blog Vendor CFPB Ncontinuity Business Continuity Third-Party Vendor Management Cybersecurity Fintech NVendor Strategic Planning Ncyber Regulatory Updates Ntransmittal Audits & Findings OCC Regulatory Compliance Company Culture Audit Nverify Compliance Management Exams FDIC Nfindings Findings NCUA Contract Management Employee Intranet Business Continuity Management Contract FRB Findings Management Enterprise Risk Management FFIEC Ncontracts manager Third-Party Vendors Vendor Risk Vendor Risk Management Wealth Management 1071 ABA Bank Access Control Artificial Intelligence Audit Findings Board Portal Call Report Compliance Risk Cybersecurity Assessment Digital Tansformation Due Diligence Efficiency Employee Engagement Exam findings FIEC Governance and Risk Management Inc. 5000 Internal Audit Management Mortgage Lending Nboardportal Verify integrated risk management
Business Impact Analysis
Risk Management

Business Impact Analysis

Oct 31, 2018 1 min read
Examiners Will Be Focusing on Your Institution’s Riskiest Areas. Do You Know What They Are?
Risk Management

Examiners Will Be Focusing on Your Institution’s Riskiest Areas. Do You Know What They Are?

Dec 7, 2018 2 min read
ERM Meaning
Risk Management

ERM Meaning

Nov 12, 2018 2 min read