Community Bank Considerations August 14, 2001

1. Technology Outsourcing and Due Diligence Community Bank Considerations August 14, 2001 Presented by: David W. Furnace Alex Sheshunoff Management Services, L.P. 98 San Jacinto Blvd., Suite 1900 Austin, Texas 78701 800-477-1772

2. Agenda • Why Due Diligence? • The Process: • Prior to the project • Analysis • Selection and Negotiation • Implementation • On-going relationship management

3. Why Due Diligence and Planning? • Community bank that changed core vendors, then could not reconcile accounts - ultimately wrote off $600k in unreconciled differences • Q-Up hack recently made public • CLMs

4. Prior to the project • Critically assess your project management skills • Formalize a Vendor Evaluation Team (VETs) - for the tangible and the intangible • Address the decision-making process • Adopt a reasonable timeline

5. Don’t make decisions too early • In-house vs. Outsourced • Limitations on the vendor list

6. Analysis • Do the “right” amount of work • Avoid the “Dog and Pony” trap • Identify Critical Business Needs • Formalize RFI/RFP • Submit to Vendors

7. Analysis • Create tool(s) for evaluating responses - Vendor Evaluation Matrix • Cut to “short list” - invest your time and energy here • vendor visits with team • site visits • other clients • Select Final Vendor

8. Selection and Negotiation • If you don’t know exactly what to pay - get help • Negotiate terms as well as price • Clearly understand who is delivering what - are there any other vendors involved?

9. Negotiate • Service Level Agreements • Ownership of Information • Security Issues • Confidentiality & Privacy • Insurance maintained • Disaster Recovery

10. Negotiate • Get test system/bank • Training • Deconversion fees • Implementation Milestones • Account Management • Third-party Reviews • Copies of incident logs

11. Negotiate • Change in Ownership of Vendor • Change in Location of servicing center • Change in control at bank • Non-assignability of contract • Resolution in the event of vendor default (for example, source code) • Auto-renewal terms

12. Implementation • WELL DEFINED project plan • Generally speaking, on complex systems parallel processing is not effective • Data Mapping • Test conversion data • Mock conversion • Live conversion

13. Implementation - Don’t • Don’t allow the vendor to dictate the conversion plan • Don’t minimize testing and assume it is fixed for conversion • Don’t skimp on training

14. On-going relationship management • Have regular vulnerability testing performed • Review service level agreements and incident logs • Analyze third-party reviews • Have an annual meeting (at a minimum) with the vendor to reassess the relationship

15. Technology Outsourcing and Due Diligence Community Bank Considerations August 14, 2001 Presented by: David W. Furnace Alex Sheshunoff Management Services, L.P. 98 San Jacinto Blvd., Suite 1900 Austin, Texas 78701 800-477-1772