Financial Services Firms: Who s Riding Herd on Your Vendors? by Jeff Picozzi

Over the past few years, the Office of the Comptroller of the Currency (OCC) and other regulators have intensified their scrutiny of banks' relationships with outside vendors. In a recent bulletin, the OCC elaborated on the growing need for vendor management, and especially for keeping a tight rein on vendors entrusted with sensitive information.

This new guidance has specific implications for records and information management, and for institutions deciding to outsource any portion of their physical or electronic records program. (For an in-depth summary and analysis of the OCC guidelines, read Mom, Apple Pie and the Office of Comptroller of the Currency.)

Vetting a Vendor? Dig, Dig, Dig

To be sure, most banks already have a formal plan governing vendor selection and oversight. That said, the OCC is advising firms to thoroughly document their plans. This includes outlining the specific processes for identifying and addressing the risks in each relationship as they apply to all applicable regulations.

Your organization's existing vendor due-diligence processes may already cover such ground as information security and incident reporting. Going forward, you can (and should) dig even deeper into each potential vendor's background, parsing every relevant variable. For example, what do you know about the vendor's strategic goals, financial stability, insurance coverage, security protocols and HR policies?

Once you establish the relationship, monitoring the vendor on an ongoing basis is crucial to ensure prompt handling of any issues.

Don't Get Lowballed-And Keep It Simple

It sounds obvious, but I'll say it anyway: If you're outsourcing your records management function, choose a company that specializes in this discipline and has the resources to meet your needs. Don't hire a records and information management firm solely based on the lowest bid. Records management for financial services requires knowledge of the industry. An experienced third-party provider can help ensure that you avoid regulatory red flags.

When vetting records-management vendors, you may be tempted to save money by parceling out your business to multiple firms. That may work-for a while. But over time, wrangling a herd of vendors, each with its own processes, fee structure and level of commitment to your business, can increase operations risk and become an administrative nightmare. As regulatory oversight intensifies, it's wise to consolidate your records management relationships, to ensure compliance and preserve your sanity.

Breaking Up: It's Really Not So Hard to Do

Yes, it's okay to end a third-party relationship. No, it's not okay to sever it via voicemail (or by unfriending the vendor on Facebook). In fact, OCC guidelines explicitly detail a bank's responsibilities when terminating a contract, including having a contingency plan for the transfer of vital functions to another vendor. The OCC also stipulates conditions for securing critical data during a transition.

The OCC's new guidelines don't dictate which outside vendors banks can and cannot hire. Rather, the commission wants to ensure you're riding herd over your vendors with appropriate vigilance-and not letting them wander off unattended.

LINK:	http://blogs.ironmountain.com/2014/industry/financial-services/financi...
	See more stories from ironmountain

Most recent headlines