Due Diligence - The Regulator’s Perspective ABA Telephone/Webcast Briefing August 14, 2001 Cynthia Bonnette, Assistant Director FDIC Bank Technology Group

Presentation Overview n Outsourcing trends and developments n Highlights of the FFIEC’s outsourcing guidance n FDIC’s brochures on technology outsourcing n Regulatory oversight of service providers n Outsourcing-related provisions of GLBA

Outsourcing Trends n TowerGroup estimates banks outsource over 85% of their information technology n Significant technical expertise and skills are required in the current environment n The cost to license software or purchase services can be lower than the cost to develop and maintain a proprietary system n Time to market and technology dynamics require rapid development and enhancement

Outsourcing Trends n What’s new about outsourcing today? –Outsourced functions include mission critical and customer-facing applications –Vendors may be new companies--less familiar with the financial services industry –Niche providers and specialization often results in multiple vendor relationships –Industry dynamics create new challenges for vendor oversight

FFIEC Guidance n “Risk Management of Outsourced Technology Services” -- FFIEC Guidance, November 2000 n Key elements of the risk management process: –Risk assessment –Due diligence in selecting service provider –Contract Requirements –Oversight of service provider Regardless of the decision to outsource, the bank remains ultimately responsible.

FDIC’s Outsourcing Brochures n FDIC recognized that community banks may face challenges in achieving the goals of the FFIEC guidance n Internal and external experts were consulted to identify areas where additional information would be useful n Goal: Provide practical information that “maps back” to the FFIEC guidance

n Three topics: –Selecting a Service Provider –Service Level Agreements –Managing Multiple Service Providers n Why did we choose these topics? n Involvement of key players –External experts (Gartner Group) –Industry representatives –FDIC experts in IT and contracting –Technology companies FDIC’s Outsourcing Brochures

n White papers were drafted and shared with the industry n The content was revised and re-circulated n Documents became available on June 4, 2001 –Bulletin announcing the brochures was issued 6/4/01 –Documents are available online at –Printed brochures are available upon request FDIC’s Outsourcing Brochures

n What they are… –Reference documents that a banker may use in relevant situations –Optional tools/resources n What they aren’t… –Official guidance –Examination procedures FDIC’s Outsourcing Brochures

Selecting a Service Provider n Objectives of the selection process n Identifying potential vendors n Evaluation and selection n Negotiating the contract n Appendix on using an RFP

Selecting a Service Provider - Tips n Negotiate flexibility - e.g., shorter term contracts n Be specific in defining responsibilities –Use institution-wide approach –Address resource allocation n Include service level agreements n Remember exit/termination clauses n Include legal counsel in the process n Don’t rush

Service Level Agreements n Definition and overview of SLAs n Four steps for developing SLAs n Tips for drafting SLAs n Tips for managing SLAs n Appendix on SLA development - details n Appendix with sample SLA “If you can’t measure it, you can’t manage it.” --Peter Drucker

Service Level Agreements - Tips n Four step process to developing SLAs: n Determining objectives –How does the outsourced service fit into the bank’s strategic plan? (e.g., customer service) n Defining requirements –What are the operating/performance needs? (e.g., availability) n Setting target measurements –What metrics can be used? (e.g., % “up time”) n Establishing accountability

Managing Multiple Provider Relationships n Examples of multiple provider relationships and related challenges n Lead-contractor structure n Inter-provider agreements n Tips for coordinating multiple providers n Appendix with tips for agreement terms and conditions

Managing Multiple Provider Relationships - Tips n Contracts should explicitly state: –Roles and responsibilities –When and how subcontractors will be used n Consider security and insurance implications n When subs are involved, determine the bank’s legal relationship and “privity” n Ensure effective communication between all relevant parties

Relationship to Regulatory Guidance and BITS Framework n The outsourcing brochures are NOT official guidance n Can be used to compliment the existing guidance and provide supplemental information and “good ideas” n Can be used as educational material or practical examples

Regulatory Oversight of Service Providers n Authority comes from the Bank Service Company Act n Interagency exams are coordinated by the FFIEC Information Systems Subcommittee –MultiRegional Data Processing Servicer Program –Shared Application Software Review Program n Recently, Internet banking service providers have been included in the MDPS program n Onsite exams are staffed by examiners from all agencies and a joint report is produced

n Copies of the exam report can be obtained by client banks only from the regional office of their federal regulator n Exam reports are not a substitute for due diligence and oversight by bank management (e.g., regular receipt of independent audits and security reviews) n The scope and frequency of the exams should be considered when using the reports as a resource Regulatory Oversight of Service Providers

GLBA Implications for Outsourcing n GLBA Section 501(b) Standards for Protecting Customer Data n Each bank shall: –Exercise appropriate due diligence in selecting its service providers –Require its service providers by contract to implement appropriate measures designed to meet the objectives of these guidelines

n Each Bank shall (continued)… –Monitor (where indicated by the bank’s risk assessment) its service providers to confirm that they have satisfied their obligations n Review audits, summaries of test results n The extent of monitoring should be based on risk assessment GLBA Implications for Outsourcing

The guidelines define a service provider broadly: “Service provider means any person or entity that maintains, processes, or otherwise is permitted access to customer information through its provision of services directly to the bank.” GLBA Implications for Outsourcing

Questions & Discussion Cynthia A. Bonnette, Assistant Director FDIC Bank Technology Group th Street, NW, Room H-1005 Washington, DC