The Great Depression of 1929 led to a number of regulatory acts intended to protect bank customers. This chapter covers the historical events and subsequent regulations from the Glass-Steagall Act to the Gramm-Leach-Bliley Act, providing the student with the knowledge of the driving issues behind the regulations.

The regulatory burden is overwhelming and only growing in scope. Very often regulations from multiple agencies often overlap. This chapter helps you sort through the proliferation of regulations, bulletins and Guidance that financial institutions must be aware of and ensure that their vendors comply with.

Some of the regulations reviewed include:

• FFIEC Guidance NCUA Part 748 FCRA
• GLBA 501(b) Disposal Rule CFPB Consumer Protection
• Privacy Act FDIC Part 364B FACTA
• Identity Theft Red Flags Guidance from the FRB and OCC from Q4 2013

Compliance is most often seen as a cost center with the perception that the benefit of being compliant is “not being fined”. This chapter presents examples of the many benefits of a compliant vendor management program and the methodology to determine the many hard dollar and soft dollar savings that can be realized. Leveraging this knowledge, a business case can be built for program funding or enhancement and gaining Executive Sponsorship.

Some of the benefits discussed include:

• Competitive Advantage
• Risk Mitigation
• Budget Control
• Reputation Protection

A filing cabinet full of folders is not a vendor management program! A program is a series of inter-related steps to be carried out inclusive of policy, procedure and process in order to achieve a goal or set of goals.

This chapter dives into the details of the 9 key components of a compliant vendor management program that every institution must address including:

• Policy Vendor Inventory Risk Rating
• Due Diligence Contract Review Periodic Review
• Contract Management Ongoing Monitoring Reporting

Once the regulations, benefits and components are understood, this chapter instructs how to put it all together and begin implementing or enhancing your program.

It addresses all steps including:

• Gaining Executive Sponsorship
• Determining which vendors to include in your program
• Assessing risk and criticality
• SSAE 16 decision tree
• Conducting Due Diligence, Periodic Review and Contract Review
• Managing the flow of documents and meeting the expectations of multiple regulators

The increased regulatory focus on vendor management programs and the high profile security breaches in recent years have given regulators cause for concern over whether financial institutions are complying with regulatory requirements to ensure that their vendors’ physical, technical and administrative controls are being properly evaluated. This chapter provides the insight gained through interviewing financial institutions across the country to provide the details needed to properly prepare for your next regulatory exam or audit. The chapter covers the 5 Vendor Management Audit Objectives along with the expected 13 controls.

Documentation discussed in this chapter includes preparation of the following:

• Segmenting and reporting on the types of Clouds utilized
• Complementary User Entity Controls assessments
• Reports on High-risk, Critical, Foreign-based, Red Flags, CFPB vendors, and the critical documents that need to be presented
• Self-identified issues

While Best Practices are not always practical for all institutions, this chapter presents a wide variety of Best Practices that have proved valuable to successful vendor management program implementations at institutions across the country.

Practices will be discussed for:

• Vendor Program Design
• Program Implementation and Management
• Risk Assessment Methodology
• Contract Management
• Successful approaches to handling vendor issues that don’t fit the mold