IT Examiner School

Meeting with EVP Anita Jones

Examiner: I met with NA Fossil and she stated you would be able to answer questions regarding the FI’s Vendor Management Program. So, there was an observation that was not in the last audit report regarding the Program on how the FI was to deal with vendors that may outsource activities. Could you give me an update as to this issue? EVP Jones: Yes, I can. I added the language that was suggested by the auditors and then asked them to review it before they left the FI. They offered up some ways to clarify this issue and I reworked the language. The updated Program is schedule for approval at the next Board meeting. EVP Jones: I can. I keep a master spreadsheet of all the vendors and which department/department manager is responsible for these vendors. I have them review vendor information and report to me annually if there are vendor changes- new and/or expired contracts- and any changes in their importance to the FI. For all high and medium designated vendors, each department manager is required to do a full write-up and provide an executive summary on top, just like we have our loan officers do for any loans for approval. So, they rank the vendors by high, medium or low so I can look for changes and adjust the spreadsheet as necessary. I then provide the vendor summary to the Executive Committee and provide the committee members any additional details as necessary. You are welcome to look and any vendor files, just let me know which ones so I can move them to on-line examiner review portal since we image all vendor information. You will have read only access. Examiner: NA Fossil also stated that you gather the vendor information from all the departments and then prepare a report to the Executive Committee. Please describe this process for me. Examiner: Thanks and I will let you know which vendors I will be reviewing. Now before you sign any vendor contracts, what is the process? EVP Jones: I review them to ensure they meet the Program standards. Also, if we have any new vendors or renewal of vendors classified as “high risk”, the Program requires I need to get a legal review to ensure the contract meets our Program requirements. The legal reviews are documented in the vendor file.