Author: The Safe Systems Compliance Team

Hey Guru!

In my last IT examination, one of the findings was that the scope and cycle of our IT audits should be more closely tied to risk. We have IT audits every 12 months, what else should we be doing?

By conducting Information Technology audits every 12 months, you’ve effectively (and correctly) determined that IT is a major source of risk in your organization. I don’t think the examiner is criticizing your decision, they’re only asking that you document how you came to that determination. Why every 12 months? Why not 6, or 18, or 24? The FFIEC Audit Handbook states that your risk assessment guidelines specify:

In the past, saying “…because that’s how we’ve always done it” might have been sufficient, but lately examiners often want a more definitive basis for IT audit scope and frequency. The Audit Handbook states that risk-based IT audit programs should:

This highlights a recent trend we’re seeing which we refer to as the “defacto scoring system”. This refers to any situation where someone in your organization makes an undocumented risk-based decision, and it happens more often than you might realize. One example is when you decide that certain vendors do not need to be included in your vendor management program because they don’t meet a minimum risk threshold. Far better to risk assess and score every vendor, then apply controls (or not) based on that inherent risk score.

Similarly, by keeping to a 12-month audit scope and frequency, someone in your organization made an undocumented determination that IT risks and controls should be reviewed on a 12 month cycle. Again, I don’t think the examiner is faulting that decision, only the decision-making process (or lack thereof).

Implementing a robust IT (or vendor) risk scoring system is not an easy task, but it is a regulatory expectation, and it seems to be where the examiner is leading you. A comprehensive risk management system will evaluate the source of risk (typically your business processes and the assets required for those processes), the risks and threats to those sources, and the controls implemented for the risks and threats identified. Apply a numeric score at each step. (I’ve oversimplifed the process a bit for brevity. This FDIC FIL is an excellent reference if you want to take a deeper dive into risk modeling.)

At this point you should be able to list all risk sources from high to low, all risks/threats from high to low, and all controls from strongest to weakest. Most importantly, risks should be scored both at the inherent level (before controls), and the residual level (after controls). Your audit plan* should then specify that your IT audits are risk-based; the scope will focus on inherent (NOT residual) risk levels for your riskiest assets, highest risks and threats, and most critical controls, and the audit cycle (frequency) will be every 12 months or less for these high-risk areas.

This approach should more than satisfy the examiner, AND as an added bonus, providing this to your IT auditor prior to the engagement will also greatly assist them as they build their scope of work.

*FFIEC IT Handbook: Audit Booklet, (Appendix B: Glossary):

• Audit Program – The audit policies, procedures, and strategies that govern the audit function, and cover all of an institution’s major activities including IT audit.
• Audit Plan – A description and schedule of audits to be performed in a certain period of time (ordinarily a year). It includes the areas to be audited, the type of work planned, the high-level objectives and scope of the work and includes other items such as budget, resource allocation, schedule dates, and type of report issued.

Other Compliance Guru posts related to this topic include: Ask the Guru: The IT Audit “Scope” and Audits vs. Examinations.

Hey Guru!

We finished a FDIC exam earlier this year, and in the IT portion they hit us on our pandemic plan saying it “needed improvement.” Here is the actual finding:

Addressing the second question first, this is a great example of having to read between the lines to determine what the examiner is really asking for. I also referred to this situation in another post. I’m guessing that the “action plan” they’re referring to is actually your succession & cross-training plan. Your recovery procedures won’t change, what they want is for you to develop your succession plan, cross-train alternate personnel, then test your recovery procedures with the alternate personnel.

We have seen this finding recently, and as a result we’ve added a succession plan section to each process in our BCP Blueprint application*. The next time you update your plan it will now prompt for the primary, secondary, and tertiary resources for each process. Just make sure the next time you conduct a BCP test (pandemic or otherwise), you test with alternate personnel in the primary recovery roles. That way you can validate your ability to recover critical processes and functions within recovery time objectives, regardless of key personnel availability AND regardless of the nature of the disaster. After all, the FFIEC guidance states that FI’s focus on the impact of the threat, not the nature of the threat:

Ultimately your ability to continue critical operations is the primary concern of the regulators, not necessarily that you’ve tested for a specific natural disaster (or contagion).

Regarding your first question, there is no specific requirement to test pandemic (or any specific threat) on an annual basis. The guidance only states that you maintain.

Because reading between the lines of an examination is an imperfect science, ask the examiner if this approach (succession plan, plus cross-training, plus testing with alternate personnel) will address their concerns. I’ll be very surprised if it doesn’t.

For more about the importance of process-based business continuity planning, check out this article: BCP Plans Continue to Draw Criticism.

*This question came from a current Safe Systems BCP Blueprint customer, but those with other plan formats can accomplish the same result by adding a succession plan section to their BCP.

Hey Guru!

We contracted with Safe Systems to help remediate exam findings, but we were told by the examiner that we are not allowed to share examination findings “under penalty of law”. How do we share this critical information with you without getting into legal trouble?

Thanks for the question, here is where this issue is coming from. The front cover of all examinations contains the following verbiage:

It goes on to say that doing so would violate Part 309 of the FDIC Rules and Regulations.

FDIC 12 CFR Part 309 is titled “Disclosure of Information”, which governs information the FDIC maintains on all financial institutions (including examination reports), and the procedures for obtaining access to such information. Subsection 309.6 (a) states:

I have always taken the opinion that if we are contracted to assist in the remediation of examination findings, we are considered an “agent” (acting on behalf of the institution) and require the examination report or the information contained therein, in order to perform our “official duties”. Of course as their agent, we are now bound by Part 309 and restricted from any further sharing of the information.

One additional thought… It’s important to see examination findings in the context of the entire report as opposed to simply being restated or copy/pasted. There are several reasons for this, primarily because often we can derive additional meaning from the broader context, allowing us to “connect the dots” between separate findings. Also because sometimes we can get additional clarity by reading “between the lines” of the report. For example, we recently assisted a customer with a finding to “Improve the Pandemic Plan within the BCP Plan”.

They went on to state that “Management should establish a clear action plan…for Pandemic.” Taken out of context, this would seem to indicate examiners wanted additional general recovery procedures in case of Pandemic. But they went on to mention “key personnel” and “employee training”, and so taken in the broader context what they were really looking for was a succession plan. Because the finding never specifically mentioned a succession plan, we may have gone in a different direction if not for seeing the entire report.

Hope this gives you a little insight into this Part 309 issue. Feel free to reach out any time with other compliance questions!

Hey Guru!

I’m looking at an FIL that came out recently (FIL-19-2019), and trying to figure out how to react to it. In your opinion, how do we “ensure that business continuity and incident response risks are adequately addressed” in our contracts? We do get copies of their BCP/IRP plans and their insurance, and we try to make sure things like IRTs in their documents match ours. Is there anything additional that you guys are suggesting we should do?

Based on the FIL, to successfully ensure that contracts with significant third-party providers* properly address business continuity and incident response, Financial Institutions should act to eliminate gaps with their key providers.

Here are the contractual specifics that examiners have identified as potential gaps in recent examinations:

1. Some contracts do not require the service provider to maintain a business continuity plan, establish recovery standards, or define contractual remedies if the technology service provider misses a recovery time objective.
2. Other contracts did not sufficiently detail the technology service provider’s security incident responsibilities. For example, details such as notifying the financial institution, regulators, or law enforcement when there was an event of a security or cybersecurity incident were not specified.
3. Additionally, some contracts did not clearly define key contract terms used in contractual documentation relating to business continuity and incident response. An example of their use of undefined/unclear key contract terms is deciding what constitutes as a “security event” or a “service interruption”.

The FIL goes on to state that:

The FIL concludes by reminding FI’s that under Section 3 of the Bank Service Company Act (BSCA), FI’s have a responsibility to report all contracts and relationships with certain service providers. The FI is responsible for notifying regulatory agencies of a relationship with a new vendor within 30 days after the service contract is created or the performance of the service, whichever occurs first. The actual reporting form is here. I provide more information on this (and have even quoted Don Saxinger, who is still with the FDIC and listed as the agency contact on the FIL!) in a previous blog post.

In summary, I think examiners expect you to more closely scrutinize your critical vendor contracts, looking for gaps that might indicate unmitigated risks. One way we address this for our customers is through testing. When we conduct testing, whether it’s a traditional disaster or a cyber incident scenario, we incorporate discussion of the actual vendor contract specifics. I.e., what does the contract say about the vendor meeting their recovery time objectives, and are their RTO’s within ours? What does the contract say about incident notification if the vendor has a cyber incident involving our data? How do they define a “recovery incident” or a “security incident”, and how does that compare to our definition? These details matter because your recovery procedures depend on what your provider is, and is not, legally obligated to do…and all that should be spelled out in the contract!

*According to regulators: “A third-party relationship should be considered significant if the institution’s relationship with the third party is a new relationship or involves implementing new bank activities; the relationship has a material effect on the institution’s revenues or expenses; the third party performs critical functions; the third party stores, accesses, transmits, or performs transactions on sensitive customer information; the third party markets bank products or services; the third party provides a product or performs a service involving subprime lending or card payment transactions; or the third party poses risks that could significantly affect earnings or capital.”