Large Bank Supervision Forum eBook

Internal Use Only Ongoing monitoring is an essential component of third-party risk management and must occur throughout the duration of a third-party relationship . . .  Banks should adapt their ongoing monitoring practices to changes to the level and type of risk over the life of the relationship. Monitoring should consider the following factors: 1. Effectiveness of relationship and consistency with strategic goals 2. Any material changes to the third party’s business strategy, legal risk, and agreements with other entities

3. Third party financial condition 4. Third party insurance coverage 5. Third party relevant audits and other reports 6. Third party compliance with applicable legal and regulatory requirements 7. Any changes in key personnel of third party 8. Third party’s reliance on, exposure to, performance of, and use of contractors 9. Adequacy of employee training of both bank and third party 10. Bank’s process to adjust policies, procedures and controls for changing threats and vulnerabilities 11. Third party’s ability to maintain confidentiality and integrity of bank records

12. Third party’s business resumption contingency planning and testing 13. Volume, nature, and trends of consumer inquiries and complaints

MUST HAVE AN EFFECTIVE DOCUMENTATION PROCESS

77

© 2023 – FinPro, Inc.

Internal Use Only

In the event of contract default or termination, banks should have well defined transition plans . . .

 In planning for termination, banks should consider the following factors: 1. The capabilities, resources, and the time frame required to transition the activity while still managing legal, regulatory, customer, and other impacts that might arise 2. Potential third-party service providers to which the services could be transitioned 3. Risks associated with data retention and destruction, information system connections and access control issues

4. Handling of joint intellectual property developed during the course of the business arrangement 5. Risks to the bank if termination happens as a result of the third party’s inability to meet expectations

78

© 2023 – FinPro, Inc.