From the Field – Page 8 – Compliance Guru

31 Jan 2011

From the Field Tom Hinkel 0 comment

OTS Using New IT Examination Questionnaire

I’m not sure if this is being used across the board for all OTS exams, or just regionally, but the new pre-examination form (officially called PERK, or Preliminary Examination Response Kit) is significantly more comprehensive than before. It’s 10 pages in length, and has the following 11 categories:

Audit (11 questions)
Management (8 questions)
Development & Acquisition (14 questions)
Outsourcing (7 questions)
Operations (8 questions)
Business Continuity Planning (6 questions)
Information Security (20 questions)
EBanking (12 questions)
Remote Deposit Capture (20 questions)
Wholesale Payment Systems (8 questions)
Retail Payment Systems (14 questions)

If these categories look familiar, they should…they are the 12 FFIEC IT Examination Handbooks, plus RDC (less Supervision of Technology Service Providers). All the OTS has done is take the Handbooks, and extract a few questions from Appendix A (Examination Procedures) of each one.

The institution that received this new exam questionnaire format is about $1B in size, and it could be that it’s only being used for larger institutions. But given that I had previously predicted an overall increase in the level of IT scrutiny, it may also be the start of the trend.

What OTS institutions can do in the meantime is become familiar with the Tier I Examination Procedures in the back of all of the IT Examination Handbooks. Prepare by using them as your own pre-exam checklist (see this). Are you seeing more detailed examination questionnaires? Let me know!

28 Dec 2010

From the Field Tom Hinkel 3 Comments

Looking back – 2010 compliance hits & misses

Every year about this time, I’m asked to look ahead to the upcoming year and prognosticate on regulatory compliance trends. I intend to do just that in a future post, but today I wanted to do something very few other prognosticators do…look back at last years’ predictions and see which ones hit and which missed (and why).

Here was the list of 2010 trends as I saw them early last year:

Risk Assessments –New standards and expectations
Documentation–Who, What, How and Why
Disaster Recovery –Compliant and Recoverable
Vendor Management –Trust but Verify

Overall I scored 2 hits and 2 misses, although to be fair the misses are more along the line of “not yet hits”. Here is how 2010 actually shaped up:

Risk Assessments – miss. This prediction was taken from the Winter 2009 FDIC Supervisory Insights Newsletter article entitled “Customer Information Risk Assessments: Moving Toward Enterprise-wide Assessments of Business Risk”. It described how examiners should start to evaluate risk on an enterprise-wide basis instead of simply focusing on information security risks. I predicted that examiners would start to adjust their examination procedures for the new criteria in 2010, but it hasn’t manifested itself in examination work papers yet. However, some of the enterprise-wide risk criteria has made its way into various risk assessment best practices. Criteria such as strategic risk, operational/transactional risk, reputation risk and legal/regulatory risk are now part of the vernacular for disaster recovery, retail payment systems and new technology risk assessments. We’ll call this a miss…for now.
Documentation – hit. The vast majority of audit and examination findings I’ve seen this year we’re not related to missing or insufficient policies or procedures, they were due to the institutions inability to document (prove) that they were following their own procedures. Expect this trend to continue in 2011.
Disaster Recovery – hit. Both auditors and examiners are finding fault with DR plans that do not strictly conform to the FFIEC guidance. Specifically, they must contain a business impact analysis, risk assessment, risk management and testing sections, and in that order. A non-compliant plan that may even be able to demonstrate (through testing) recoverability will still be written up. (More here.)
Vendor Management – miss. With the increasing reliance of financial institutions on third-party vendors, I predicted that 2010 would be the year that the examiners started scrutinizing vendor management programs more closely. It hasn’t happened…yet. It may be because of the continued overwhelming emphasis on asset quality during the safety and soundness examination, but I’m leaving this on the list for 2011. Asset quality will undoubtedly still dominate in 2011, but there are indications that the pendulum is starting to swing back around. (More on that later.)

My next post will be my predictions for 2011. I’m also collecting survey responses from auditors and examiners on where they think the areas of focus will be, and I’ll report that in early 2011 as well.

All the best for a Happy and Compliant New Year!!

16 Dec 2010

From the Field Tom Hinkel 4 Comments

The IT Steering Committee – Should or Must?

At a recent user group meeting of one of the major core vendors for community banks, I asked the question ‘how many of you use an IT or Tech Steering Committee?’. I was expecting a vast majority of hands to go up, but only about half did. This was surprising to me, given that:

The FFIEC all but mandates this committee,
The FDIC strongly encourages it,
Auditors recommend it, and
It provides a mechanism to address many of the most difficult examination questions

First, the FFIEC mandate. On page 5 of the Management Handbook, it states:

Many boards of directors choose to delegate the responsibility for monitoring IT activities to a senior management committee or IT steering committee…The committee should consist of representatives from senior management, the IT department, and major end-user departments.

Some institutions may call it a Tech Steering Committee, or have another name for it, but in “FFIEC-speak”, if “many” choose to do this, you better have a pretty good reason if you decide not to do it. In fact in Objectives 3, 4 and 5 of the Examination Procedures, the examiner is instructed to review;

…the membership list of board, IT steering, or relevant management
committees established to review IT related matters.
…the minutes of the board of directors and relevant committee meetings
…IT oversight program, to determine if the Board…established a steering committee, and
…the effectiveness of the reports used by senior management or
relevant management committees.

The FDIC strongly encourages the use of an IT management committee in their IT Officers Questionnaire. Part 1 (b) asks for “the names and titles of individuals, committees, departments or others participating in the risk assessment process”. And as I addressed in my series of the trickiest questions on the questionnaire, this committee, and the documentation it produces, can help you document adherence with many aspects of your IT risk management process.

Finally, most of the recent findings in IT audits are due to institutions’ inability to document that they are following their own policies. The policies themselves are sufficient, and the institution may indeed be complying with them, but because of non-existent or inadequate documentation they can’t prove that they are. And in today’s compliance environment, if you can’t prove you’re doing it, you aren’t doing it.

Given it’s overall importance, consider the IT Steering Committee a “must”. If you don’t have one, make a New Years resolution to establish one. Give it a mission to assist the board in overseeing IT-related activities. Make sure it consists of members from all departments, and work from a standardized meeting agenda. Lastly, document each and every meeting, and periodically report to the Board. Better audits and examinations in 2011 will be the fruits of your labor.

30 Nov 2010

From the Field Tom Hinkel 1 Comment

5 Key Elements of Risk Management

As a financial institution, it sometimes seems that everything you do requires a risk assessment. Information security, disaster recovery, ID theft, remote deposit capture, outsourcing, in fact the term “risk assessment” appears 215 times in the FFIEC IT Examination Handbooks. But a risk assessment is only one step of a five step risk management process…and it’s not even the first step.

I think the regulators unnecessarily confuse the issue by conflating “risk assessment” with “risk management”. Sure it’s important to assess risk, but unless you’ve correctly identified the assets to be protected, you’re assessment will be off target. And once you’ve correctly identified the assets, and assessed the risk to those assets, you must design a system of controls to avoid, reduce and transfer the risk down to an acceptable level. And then, because the environment in which the risks and controls exist is not static, you’re still not done managing. You must constantly repeat the process.

The process is further complicated by the fact that there is no one standard for documenting risk management. Although it would be so much easier for both the institution and the regulator if there were a standard checklist or matrix. Easier for the institution to implement, and much easier for the regulator to follow. (In fact, in my opinion a standardized risk management process would have been a mutually beneficial outcome from Dodd-Frank…it would benefit institutions, regulators, and the public.)

So, lacking a universal standard for risk management, how do you proceed? Again, the FFIEC handbooks provide guidance here. I mentioned earlier how often the term “risk assessment” appeared in the handbooks, but the term “risk management” appears even more often…303 times total. The essential elements of an effective risk management program are:

Identify the assets to be protected. What are you protecting (i.e. customer information, critical business processes, etc.), and why (privacy, security, etc.)?
Identify the threats to those assets. What could happen to the assets identified in step 1? Rank the threats by both impact and probability. (This is the traditional risk assessment step.)
Apply controls in a layered, overlapping way until the risks are reduced to an acceptable level.
Test the adequacy and effectiveness of the controls.
Monitor the program and periodically repeat the process.

Remember, exactly how this is documented is up to the institution. Most choose to utilize a matrix, others use a narrative, but regardless of how it’s done the process should include all 5 of these elements.

So next time you hear an auditor or regulator ask for a risk assessment, what they are really asking for is one step in your overall risk management program. Deliver it to them as part of the program and you’ll never come up short.

24 Nov 2010

From the Field Tom Hinkel 1 Comment

Thankful for…Appendix A?!

When you were a kid, you hated the “pop quiz” right? But if the teacher allowed you to use your notes and textbooks, you felt like you at least had a fighting chance. I’ve taken both proctored and “open book” certification exams, and I’ve always felt that open-book exams more accurately reflected how most of us retrieve and use information. Most of us can’t possibly commit everything we need to know to memory, but if we know where to go to get the information, we have a fighting chance of finding the right answer.

That’s exactly how it is with an audit or examination. In my position I assist many many customers with audits and examinations. I see a lot of folks treat the pre-exam experience as a “pop-quiz”, with associated high anxiety levels. They dread the unpredictability of both the “test questions” and the correct answers. “What are they going to ask…and how should I respond?” But in reality, all IT examinations are actually open-book, and the books are the FFIEC IT Examination Handbooks. And the best part is that the Handbooks contain both the questions and the answers!

In the back of every single one of the 12 Handbooks is a section titled “Appendix A – Examination Procedures”. All of your examiners’ questionnaires and work papers are drawn from these sections. Granted, most of the examinations use only a small sub-set of the items in Appendix A, but if you use this section as a quick checklist at least you’ll know how prepared you are. In the past couple months, I’ve heard two different FDIC IT examiners make the same statement when asked “how do we know that we’re compliant…?”, and the answer was “easy, because we give you the answers up front!”

So there’s one more thing to be thankful for tomorrow!

I hope you have a wonderful Thanksgiving!

11 Nov 2010

From the Field Tom Hinkel 0 comment

Dodd-Frank and regulatory compliance

In an excellent article by Lori Moore of ATTUS Technologies, she states that there are multiple reasons why bank examiners may be ramping up scrutiny:

“Examiners who may already be on the defensive in regard to criticism about their actions prior to the fall 2008. Examiners who now have the Dodd-Frank Act on their side, giving them more authority. Examiners who in conjunction with Dodd-Frank have been charged with heightening their scrutiny of all consumer protection compliance.

No doubt, examiners are going to get tough. A decree recently stated by a representative from the OCC: “Fair but tough”. In fact many anecdotal reports confirm this is already happening.”

The difference between “tough but fair”, and “fair but tough” is much more than semantic. It means that “tough” is the operative word. As the pendulum of regulatory focus swings from credit risk back to regulatory risk, expect regulators (and auditors) to spend more time scrutinizing your information security policies, procedures and practices.

← Previous 1…789 10 Next →