Large Bank Examination Workshop February 2026

Third Party Vendor Issues • External models may not allow full access to computer coding and implementation details, so there may be more reliance on sensitivity analysis and benchmarking. • Firm must have as much knowledge in-house as possible in case the vendor or the organization terminates the contract for any reason, or if the vendor is no longer in business. • Contingency plans for instances when the vendor model is no longer available or cannot be supported by the vendor.

131

Validation Reports • Should include observations/findings ranked by severity (high, medium, low) • Should have some kind of recommended remediation action • Generally, include some sort of preliminary response

from management  Agree or disagree

 Identification of risk owner  Remediation plan/timeline

132

66

© Global Financial Markets Institute Inc.