Author: Tom Hinkel

Last time in Part 3 we discussed (at some length) the FDIC IT Exam question “Are project management techniques and system development life cycle processes used to guide efforts at acquiring and implementing technology (Y/N)?”.  This time, we address a question from the Part 3 – Audit/Independent Review Program section titled:

“Are the results of your audits/independent reviews used to adjust your risk assessment findings/results (Y/N)?”

I’m going to give you a 2 for 1 bonus on this one.  There is another question just after this one that is closely related, so we’ll address them both at the same time:

“Do you have a system for tracking audit and regulatory exceptions to final resolution (Y/N)?”

They should really be asked in the reverse order, because if you have a “system” in place for tracking audit findings, it would necessarily address (as the final step in the audit process) adjusting your risk assessment findings.  It would serve no useful purpose to submit to the time and expense of an audit, only to discard the findings.  Nevertheless, you want to answer “Y” to both questions, and the proper way to document your answer is found in the references for both questions.

Both questions share the first reference (FDIC Rules and Regulations Part 364 Appendix B Section III (C)(3) and (E)), which states:

Section III (C)(3) – “Each Bank shall…Regularly test the key controls, systems and procedures of the information security program. The frequency and nature of such tests should be determined by the bank’s risk assessment. Tests should be conducted or reviewed by independent third parties or staff independent of those that develop or maintain the security programs.”

And,

Section III (E) – “Adjust the Program. Each bank shall monitor, evaluate, and adjust, as appropriate, the information security program in light of any relevant changes in technology, the sensitivity of its customer information, internal or external threats to information, and the bank’s own changing business arrangements, such as mergers and acquisitions, alliances and joint ventures, outsourcing arrangements, and changes to customer information systems.”

Simply put, you must first test the controls in your risk management program, and then adjust your program with the results of the findings.  How do you prove compliance?  The answer is found in the details of your audit program, specifically with your external auditor.  The terms of the contract with your auditor determine the nature, scope and objectives of the audit engagement.   An information security audit (sometimes referred to as a GLBA audit), will by definition include coverage of the key controls, systems and procedures of your information security program.

But just because you have an audit program, you haven’t directly addressed the questions just yet.  What do you actually do with the findings from the audit?  Whenever the FFIEC mentions a “system”, what they usually mean is that its formalized (policy driven), standardized (operates in a committee, and from an agenda), and documented.  So what committee in your organization is tasked with IT security?  If you follow FFIEC guidelines, it’s probably your IT Steering Committee.  It’s logical then that IT related audit findings would be presented there as well.  (Some institutions have a separate audit committee, but if audit findings require changes to IT policies or procedures, they would still need to be presented to IT Steering for implementation.)

So the correct answer to both questions is “Yes, the findings from our information security audits are presented to the IT committee, and are used to adjust our information security program.”

We’re down to the last of the 5 trickiest questions, and I’m going to turn to you for the final post in this series.  What IT audit or examination question(s) have you had the most difficulty with? Leave a comment at the  bottom, or send me an email, and I’ll discuss not only the correct answer, but most importantly how to answer the “If Yes,…” part.

Last time in Part 2 we tackled “Does the bank’s strategic planning process incorporate information security (Y/N)?” from the FDIC IT Examination Questionnaire. This time we take a closer look at another question that stumps many institutions preparing for examination;

“Are project management techniques and system development life cycle processes used to guide efforts at acquiring and implementing technology (Y/N)?”

This is the last of 25 questions in the PART 2 section Operations Security and Risk Management, and as with most of the other questions, you want to be able to answer “Y” to this.  Although there is no explicit “if Yes,…” followup to this question (as there is to 14 other questions), you really don’t want to answer “Y” to anything unless you can document your answer.  But how, exactly, do you document compliance with this?  As with many of these trickier questions, it actually carries multiple presumptions:

• You have established Project Management Techniques,
• You have established System Development Life-Cycle Processes,
• You utilize both when Acquiring and Implementing Technology.

It’s important to add here that I have not personally seen any particular increased scrutiny in this area.  Most institutions simply answer “Y”, and move on without consequence.  But before you decide that documenting compliance with this is too difficult (or unnecessary), remember that for every “Yes” answer, there is an implicit (if not explicit) “If Yes,…” response required.  So let’s take a look at the references.  The first is the FFIEC IT Examination Handbook, Development and Acquisition, December, 2003.

This is the only question in the FDIC questionnaire that references this particular handbook, so it’s easy to see why this manual is often overlooked when preparing for an IT examination.  Additionally, how many financial institutions really utilize the System Development Life Cycle (SDLC) methodology when managing their technology projects?  (Very, very few that I am aware of.)  Still, having a basic understanding of effective project management is a good thing, because as the handbook states on page 3, “Project management in its basic form involves planning and completing a task.”  This is done every day…and by most institutions, several times a day.  So what does it take to demonstrate “Project Management Techniques”?  Fortunately, the FFIEC does not expect you to become experts in the latest PM techniques and methodologies:

“Examiners should not expect organizations to employ elaborate project management techniques in all situations.”

However,

“The critical importance technology plays in financial institutions dictates the use of appropriate development, acquisition, and maintenance standards. Standards do not guarantee that organizations will appropriately develop, acquire, and maintain technology systems. However, standards do enhance management’s control over projects, thereby decreasing project risks.”

So, how do we define (and document) “appropriate standards”?  Regardless of the exact methodology used, all successful projects have the following characteristics:

• Detailed project plans (including integration with the overall strategic plan)
• Clearly defined expectations and objectives
• Realistic budgets
• Participation by all departments impacted by the project
• Effective communication

The best way to accomplish all of these is by incorporating discussion of IT projects (proposed, in process, and implemented) into your regular IT Steering Committee meetings.  If the meetings are well attended, agenda driven, and documented, the correct answer to the question is “Yes. We acquire, implement, and maintain technology according to a risk-based management process, and document the process in our IT Steering Committee.”

By the way, I mentioned that there were multiple references for this question.  The other reference cited is for FDIC FIL-12-99.  Although this is too complex to cover adequately in this post, the referenced FIL discusses the Uniform Rating System for Information Technology (URSIT), and it’s four critical components: Audit, Management, Development and Acquisition, and Support and Delivery (AMDS), and specifically how these components are used to assess the overall performance of IT within the organization.  As the IT Composite Rating affects the institutions’ overall CAMELS rating, it is important enough to cover in more detail in a future post.  (I actually covered the “Management” element in a previous post.)

Next, in Part 4: “Are the results of your audits/independent reviews used to adjust your risk assessment findings/results (Y/N)?”

Last time we addressed a question from the FDIC IT Examination Questionnaire, found in PART 2, OPERATIONS SECURITY AND RISK MANAGEMENT titled “Do you have a process in place to monitor and adjust, as appropriate, the information security program”.

This time, we take a closer look at another potentially troublesome Part 2 question;

“Does the bank’s strategic planning process incorporate information security (Y/N)?”

Once again, the optimal answer is “Y”, but documenting compliance is a bit tricky because this is a complex question.  In fact, it’s really several questions with multiple parts, all requiring a “Y” answer.

1. Do you have a strategic planning process?
   1. Do you have an enterprise-wide strategic plan?
   2. Do you have an IT strategic plan?
2. Does the IT strategic plan support the overall enterprise-wide  strategic plan?
3. Do you have an risk-based information security program?
4. and finally (assuming “Y” to all the above)… Does your strategic planning process incorporate information security?

The reference for this is the FFIEC IT Examination Handbook, Management, June 2006, and although the entire document is an excellent guide for how management can address and control information security, I think the most relevant reference to the issue of strategic planning and information security is found on page 22:

“IT strategic plans provide insight into the organization’s planning process. Review and analysis of the strategic plans as part of the risk assessment process (my emphasis) may spotlight developing risk  exposures or other deficiencies that limit the institution’s ability to  implement strategic priorities.”

The FFIEC suggests that strategic planning be incorporated into the risk assessment process.  As I mentioned in my previous post, (and highly recommended by the FFIEC on page 5 of the same Management Handbook) the IT Steering Committee is the most logical forum for risk assessment process provided the committee consists of representatives from all departments, operates from a standardized agenda, and keeps meeting minutes.  (There is one more requirement; that it assign responsible parties to the issues and findings that arise in the meetings, and follow them through to resolution.  More about this in my next post).

So, assuming you have both an overall strategic plan, and an IT strategic plan, and assuming you incorporate discussion of these plans in the risk assessment section of your IT Steering Committee agenda, then the answer to this question is “Yes, The process is guided by the FFIEC Management Handbook, coordinated by our IT Committee, and documented in the meeting minutes.”

Next time, in Part 3;  “Are project management techniques and system  development life cycle processes used to guide efforts at acquiring and implementing technology (Y/N)?”

…and how to answer them.  Actually, answering them is the easy part, they all require a “Y”.  Documenting the basis for your answer is a bit harder.  Because each question really requires it’s own discussion, I will address each one in separate posts.  Also, the questionnaire I will be referring to is the newer 12/07 version, the one with Part 5 titled “Vendor Management and Service Provider Oversight”.  I’ll use this because it is the most recent, and as I posted previously, some State Banking regulators have started adopting it as well.

So, our first question is found in the “Part 2 – Operations and Risk Management” section, and asks:

“Do you have a process in place to monitor and adjust, as appropriate, the information security program (Y/N)?”

The reference for this question is found here, and again, the optimal answer is “Y”.  In FDIC-speak, a “process” means assigned to a committee (or other responsible party), guided by an standardized agenda, and documented.  The Board of Directors and Senior Management are ultimately responsible for the information security program, but often delegate day-to-day responsibility to an IT or Technology Committee.  This practice is strongly encouraged by the FFIEC, which states in the IT Examination Management Booklet that;

“Many boards of directors choose to delegate the responsibility for monitoring IT activities to a senior management committee or IT steering committee.”

Since the IT Committee should already have responsibility for day-to-day IT governance, placing them in charge of the information security program is a natural extension of their duties.  Simply make sure that the committee operates from a standard agenda, and that all meetings are documented.  Your full answer to this question is “Yes.  The process is coordinated by our IT Committee, and documented in the meeting minutes.”

Next…“Does the bank’s strategic planning process incorporate information security (Y/N)?”