2023 IT Examiner School

Internal Use Only

FFIEC IT Service Provider Examinations • ROEs are generated and are available for: • State Banking Departments (get from CSBS, FDIC, FRB, or NCUA) • Insured Financial Institutions (only if an active client) • Only primary federal regulator can release them to FIs (banks and CUs) • States don’t have authority to release these ROEs to financial entities • For FIs, they only get the Open Section and no IT Ratings • SBDs get full copy of ROE

Internal Use Only

IT Management Component Rating  IT management rating is based on FFIEC Uniform Rating System for Information Technology (URSIT)  InTREx process (depository institutions) calls for assigning a Management component rating for IT  Like CAMELS, this component rating plays a key role in the overall URSIT composite rating & is rated on the same criteria, but based solely on IT/operations activities  Additional URSIT information, components & ratings are discussed in other modules