Copyright © 2014 Lender Performance Group, LLC. All rights reserved. Managing risks associated with third-party relationships, in other words Vendor Management Presenters: Joel Rosenberg, CFA Chris Nelms, CISM, CRVPM loan pricing & profitability management solution

Vendor Management OCC guidance issued late 2013 Appendix J by FFIEC Vendor Management, referred to as third-party service provider (TSP) Comprehensive risk management and oversight Lender Performance Group LLC Confidential Material 2

Use of third party vendors (TSP) increasingly complex Outsourcing entire departments Outsourcing business lines More Traditional Activities Issues: Customer Contact Domestic and/or foreign subcontractors Lender Performance Group LLC Confidential Material 3

Vendor Management Life Cycle Lender Performance Group LLC Confidential Material 4

5 steps in Risk management Life Cycle Lender Performance Group LLC Confidential Material 5 Developing a plan Review of TSP pre-contract Contract - expectations and responsibilities Monitoring Termination Parallels to the lending process, new loan product introduction

Parallels to what an Institution does in introducing a new loan product Planning Due Diligence- Underwrite the 5 C’s Contract Negotiation-Loan Documentation On Going Monitoring- Credit Analysis, ROE Termination- Loan Paid or other options Lender Performance Group LLC Confidential Material 6

Planning Lender Performance Group LLC Confidential Material 7 TSP Management Strategic purposes Compliance aspects Complexity Potential information security implications Inherent risks of using vendors Board presentation and approval of critical activities

New Loan Program Parallel- Planning Market and need Customer interaction Compliance aspects Inherent risks -Credit, IRR, Regulatory Administration Lender Performance Group LLC Confidential Material 8

Due Diligence- TSP Lender Performance Group LLC Confidential Material 9 Vendor’s business strategy Licenses, fidelity bond coverage Financial condition Resources and experience TSP fee structure and incentives Information security programs Reliance on subcontractors

Due Diligence- Loan Program Underwriting Criteria Type of borrower Financial condition Experience 5 C’s Underwrite in-house or TSP Lender Performance Group LLC Confidential Material 10

Contract Negotiation- TSP Lender Performance Group LLC Confidential Material 11 Nature of Arrangement Performance Measures or Benchmarks The Right to Audit (SSAE 16, SOC1, SOC 2, SOC 3 reports) Cost and Compensation Business Resumption Plans Dispute Resolution Default

Contract Negotiation- Loan Program Provisions and terms Pricing methodology (ROE targets) Default Performance Measures Report requirement Lender Performance Group LLC Confidential Material 12

Ongoing Monitoring - TSP Lender Performance Group LLC Confidential Material 13 Bank’s risk operation Critical activity Regular on site visits Vendor controls, service-level agreements Key personnel and retaining essential knowledge Subcontractors –reliance and performance

Ongoing Monitoring – Loan Program Periodic client reports Spreading the financials Collateral monitoring Regular on site visits Client key personnel changes Lender Performance Group LLC Confidential Material 14

Termination- TSP Lender Performance Group LLC Confidential Material 15 The bank may terminate third-party relationships 1.expiration or satisfaction of the contract 2.bring in alternate TSP 3.in-house 4.breach of contract In-house option, planned or not: 1.capabilities, resources, and the time frame 2.risks - data retention and destruction 3.handling of joint intellectual property 4.reputation risks

Termination- Loan Program Ending the Loan Program Foreclosure experience All existing loans pay off Sale or transfer Reputation Risk Personnel Considerations Lender Performance Group LLC Confidential Material 16

Oversight and Accountability Board of Directors Effective process is in place Approve the bank’s risk-based policies Review due diligence Approve contracts that are critical activities Senior Bank Management Implement the bank’s TSP plan or Loan Program operation Due diligence Review and approve contracts/loan documents Ensure periodic independent reviews Oversee ERM Lender Performance Group LLC Confidential Material 17

Oversight and Accountability Lender Performance Group LLC Confidential Material 18 Bank Employees Conduct due diligence Perform ongoing monitoring Escalate significant issues Tested controls in place Maintain appropriate documentation Respond to material weaknesses

Independent Reviews Ensure that periodic independent reviews are conducted Reviews should assess : ensuring third-party relationships and loan program align with the bank’s business strategy risks material breaches and service disruptions identifying and managing concentration risks ensuring that conflicts of interest do not exist Lender Performance Group LLC Confidential Material 19

Vendor Management ( TSP ) Lender Performance Group LLC Confidential Material 20 Vendor Management is your first line of defense against security breaches. Stop the checkboxes! Create a program

Vendor Management Lender Performance Group LLC Confidential Material 21 Obtain Executive Sponsorship Create a vendor management Committee. Create a centralize vendor management program. Gain buy-in!

Vendor Management Lender Performance Group LLC Confidential Material 22 Create a vendor inventory Categorize all vendors Remove the silo

Other Sources Lender Performance Group LLC Confidential Material 23

Questions Presenter: Joel Rosenberg and Chris Nelms Contact: Phone: (980) Lender Performance Group LLC Confidential Material 24