Vendor Risk: Effective Management is Essential

1. Vendor Risk:Effective Management is Essential Michael Masterson Vice President Union Bank Vendor Risk Administration

2. Agenda • Importance of Properly Managing the Risks • Components of a well-structured vendor risk management process • Decentralized to Centralized/Center-Led • Tools and Resources

3. Importance of Properly Managing the Risks • You can’t pass the responsibility for managing activities in a safe and sound manner and in compliance with all applicable laws and regulations on to the vendor. • Decreased direct control requires intensified oversight • The bar has been raised • Unfair, Deceptive or Abusive Acts and Practices (UDAAP) • CFPB • Familiar risks…with a twist • Strategic/Operational Risk • Ill-advised business decisions • Products/services that do not help achieve strategic goals • Return vs. cost and risk • Integrating the internal processes of other organizations with the financial institution’s processes can increase the overall operational complexity.

4. Importance of Properly Managing the Risks • Reputation Risk • Poor service = dissatisfied customers • Negative publicity involving the vendor • Compliance Risk • Violation of laws, rules, or regulations • Nonconformance with internal policies and procedures or ethical standards • Increased when the vendor maintains or has access to non-public information • Transaction Risk • Product delivery errors or failure • Inadequate security controls • Inadequate business resumption and contingency planning

5. Importance of Properly Managing the Risks • Credit Risk • Risk to earnings or capital if vendor does not perform or have the financial capacity to fulfill its obligations • Other Risks • The types of risk introduced by an institution's decision to use a third party cannot be fully assessed without a complete understanding of the resulting arrangement. Therefore, a comprehensive list of potential risks that could be associated with a third-party relationship is not possible. • Country Risk • Economic, social, and political conditions and events

6. Components of a well-structured vendor risk management process • Risk Assessment and Strategic Planning • Integration with overall strategic objectives • Internal expertise to oversee and manage the activity • Cost/benefit relationship • Customer expectations with respect to joint marketing and franchising activities • Objective assessment of inherent risks • Selecting a Third Party and Due Diligence How formal the process is and the level of due diligence depends on the complexity of the service to be performed and the associated risks

7. Components of a well-structured vendor risk management process • Comprehensive due diligence involves a review of all available information about a potential third party, focusing on the entity's financial condition, its specific relevant experience, its knowledge of applicable laws and regulations, its reputation, and the scope and effectiveness of its operations and controls. The evaluation of a third party may include the following items: • Audited financial statements, annual reports, SEC filings, and other available financial indicators. • Significance of the proposed contract on the third party's financial condition. • Experience and ability in implementing and monitoring the proposed activity. • Business reputation. • Qualifications and experience of the company's principals. • Strategies and goals, including service philosophies, quality initiatives, efficiency improvements, and employment policies. • Existence of any significant complaints or litigation, or regulatory actions against the company. • Ability to perform the proposed functions using current systems or the need to make additional investment. • Use of other parties or subcontractors by the third party. • Scope of internal controls, systems and data security, privacy protections, and audit coverage. • Business resumption strategy and contingency plans. • Knowledge of relevant consumer protection and civil rights laws and regulations. • Adequacy of management information systems. • Insurance coverage.

8. Components of a well-structured vendor risk management process • Contract • The agreement should include clearly defined and enforceable expectations and obligations of each party • Include the right to audit • Responsibilities for providing and receiving information • Confidentiality and security • Regulatory oversight when services are performed for the financial institution • Oversight • Extent of oversight activities and performance monitoring depends on the nature of the product or service provided and the associated risk • Management should dedicate sufficient staff with the necessary expertise to oversee the third party

9. Components of a well-structured vendor risk management process • Monitor Financial Condition • Analysis should be as comprehensive as the ongoing credit analysis the financial institution would conduct of its borrowers • Review adequacy of the insurance coverage • Monitor Controls • Review audit reports • Review vendor policies relating to internal controls and security • On-site reviews • Review business resumption contingency planning and testing • Review compliance with applicable regulations

10. Components of a well-structured vendor risk management process • Assess Quality of Service and Support • Regularly review documentation of vendor’s performance relative to contractual terms and conditions and SLAs • Document and follow-up on performance problems • Evaluate the vendor’s ongoing ability to support and enhance the financial institution’s strategic plan and goals • Training provided to financial institution employees • Review complaints and resolution • Discuss performance and operational issues with internal areas the vendor touches

11. Components of a well-structured vendor risk management process • Documentation • Business plans for new lines of business or products that identify management’s planning process, decision making, and due diligence in selecting a third party • List of significant vendors or other third parties • Valid current and complete contracts • Regular risk management and performance reports • Regular reports to the board, or delegated committee, of the results of the ongoing oversight activities

12. Decentralized to Centralized/Center-LedVendor Risk Management Program • Drivers • Responsible personnel should have the requisite knowledge and skills to adequately perform the steps necessary to properly identify and control the risk • The need for information • Increased use of third parties • Where to start • Executive champions • Define manageable pieces • Assessment • Assemble information • Develop the process and tools • The importance of understanding at all levels • Training • Continuous process improvement

13. Tools and Resources • Vendor Management Software • Agiliance • Aravo • RSA Archer • Ariba • Evantix • Fortrex/Vendorpoint • MetricStream • Modulo • SAP • Vendor Management Groups • BITS Vendor Management Special Interest Group (http://www.bits.org/initiatives/) • Shared Assessment Group (http://sharedassessments.org/about/)

14. Tools and Resources • Regulatory Guidance • OCC 2001-47 • FDIC FIL-44-2008 • FFIEC Outsourcing Technology Services June 2004