FCA Essential Practices for Information Technology
Based on Industry Standards and FFIEC Examination Guidance
Table of Contents
Page
Technology Service Provider and Service Receiver
Introduction...................................................................................................................................SPR - 1
Examination Objectives................................................................................................................SPR - 1
Examination Procedures ..............................................................................................................SPR - 1
Essential Practice Statements .....................................................................................................SPR - 2
Risk Assessment...................................................................................................................SPR - 2
Due Diligence........................................................................................................................SPR - 2
Contract.................................................................................................................................SPR - 2
Monitoring..............................................................................................................................SPR - 3
Technology Service Provider and Service Receiver
Introduction:
The intense competition in the financial services industry has caused institutions to actively seek ways to cut costs and
focus on their primary business. The rapid changes in information systems technology have caused many institutions to
contract with third-party organizations for information processing, including mission critical applications. This interchange
of services between organizations involves certain risks and responsibilities that must be addressed by both the service
provider and receiver. While some of these can be defined and delegated within the service level agreement, others must
be handled by each party through the implementation of proper operational controls. Legal counsel who is familiar with
the terminology and specific requirements of a data processing contract should review it to protect the institution’s
interests and avoid or minimize problems in the contractual arrangement. This may require hiring legal counsel with
specialization in IT issues.
Examination Objectives:
Determine if the board and management have established and maintained effective controls for technology services
provided or received. This is accomplished through the following examination objectives:
• Board and Management Oversight – Assess the adequacy of board and management’s risk assessment and due
diligence efforts.
• Contract Management – Evaluate contracts and service level agreements to ensure technology service provider
and receiver expectations are clearly defined.
• Performance Monitoring – Assess management’s ongoing monitoring of the technology service provider or
receiver and related contracts.
Examination Procedures:
Examination activities should be based on the criticality and complexity of the business functions present at the institution.
The examination should begin with a review of audit activities and the risk assessment for technology service providers
and receivers. At a minimum, the Essential Practices for Technology Service Providers and Receivers should be clearly
documented and functioning within the internal control environment. More in-depth examination procedures (such as
those found in the
FFIEC Supervision of Technology Service Providers Booklet and the Outsourcing Technology Services
Booklet) should be evaluated and incorporated into the examination scope as an institution’s size, risk, and complexity
increases.
FCA Essential Practices for Information Technology SPR - 1
Service Provider and Service Receiver Section
Conduct a risk assessment to ensure an outsourcing
relationship is consistent with an institution’s short- and
long-term goals. A risk assessment considers:
• Strategic goals and objectives of the institution;
• Staff’s ability to oversee outsourcing relationships;
• Importance of the services to the institution;
• Contractual obligations and requirements for the
service provider;
• Contingency plans, including availability of
alternative service providers, costs and resources
required to switch service providers; and
FCA Informational
Memorandum, “Risk
Management of
Outsourcing” (Oct. 25,
2000).
Technology Service Provider and Service Receiver
Element
Essential Practices Statement
Industry Standard
Reference
FFIEC IT
Examination
Handbook
Reference
Risk Assessment
Outsourcing
Technology Services
Booklet (Jun. 2004),
p. 5.
Audit Booklet (Aug.
2003), pp. 21-22.
Supervision of
Technology Service
Providers Booklet
(Mar. 2003), pp. 1,
4-5.
• Necessary controls and reporting processes.
Reason:
The board of directors and senior management are responsible
for understanding the key risks associated with outsourcing
arrangements and ensuring that effective risk management
practices are in place.
Due Diligence
Management
Booklet (Jun. 2004),
p. 32.
Information Security
Booklet (Jul. 2006) pp.
76-77.
Perform and document due diligence to ensure technology
service providers are managed adequately, competent
technically, stable financially, and insured appropriately.
Reason
:
Performing the due diligence allows management to evaluate
service providers to determine their ability, both operationally
and financially, to meet the institution’s needs. Insurance
coverage provided by the service provider should complement
and supplement the institution’s coverage. The coverage
should be reviewed to determine if it is adequate and
consistent with what the institution would have purchased
without an external provider. Where the service provider’s
coverage is not sufficient, the institution should consider
obtaining additional coverage.
FCA Informational
Memorandums,
“Outsourcing of
Technology-related
Products and Services”
(Jan. 16, 2001);
“Risk Management of
Outsourcing” (Oct. 25,
2000).
Outsourcing
Technology Services
Booklet (Jun. 2004),
p. 11.
Supervision of
Technology Service
Providers Booklet
(Mar. 2003), p. 6.
Management Booklet
(Jun. 2004), pp. 22,
32, 36.
Information Security
Booklet (Jul. 2006) pp.
76-77.
Include the following elements in the written contract:
• Quality measures (Service Level Agreements or
Contract
ISO/IEC 17799:2000,
Section 4.2.2, “Security
Outsourcing
Technology Services
Booklet (Jun. 2004),
FCA Essential Practices for Information Technology SPR - 2
Service Provider and Service Receiver Section
minimum levels of service);
• Pricing;
• Data ownership and confidentiality;
• Right to audit (by institution and FCA);
• Control expectations (i.e., security, change control,
systems development, etc.);
• Remediation; and
• Reporting expectations for the Technology Service
Provider to the institution.
Technology Service Provider and Service Receiver
Element
Essential Practices Statement
Industry Standard
Reference
FFIEC IT
Examination
Handbook
Reference
pp. 12-19
Supervision of
Technology Services
Booklet (Mar. 2003),
p. 1.
Management
Booklet (Jun. 2004),
pp. 34, 36-38.
Reason:
Documenting these measures ensures the institution’s interests
are protected, misunderstandings are minimized, and ongoing
service is provided that is consistent with expectations.
Monitoring
E-Banking Booklet
(Aug. 2003), pp. 23-
24.
Perform and document reviews of service provider’s
financial information, internal audit reports (e.g., SAS 70),
status reports, and service level agreement reports.
Reason:
It is essential that institutions implement an oversight program
to monitor each service provider’s controls and performance.
Although services may be outsourced to achieve certain
benefits, the responsibility for outsourced activities remains
with FCS institutions’ boards of directors. Documenting the
process is important for contract negotiations, termination
issues, and contingency planning. Specific personnel should
be assigned responsibility for monitoring and managing the
service provider relationship. The number of institution
personnel assigned and the amount of time devoted to
oversight activities will depend in part on the scope and
complexity of the services outsourced.
FCA Informational
Memorandums,
“Outsourcing of
Technology-related
Products and Services”
(Jan. 16, 2001);
“Risk Management of
Outsourcing” (Oct. 25,
2000).
Outsourcing
Technology Services
Booklet (Jun. 2004),
pp. 20-24
Supervision of
Technology Service
Providers Booklet
(Mar. 2003), p. 6.
Management Booklet
(Jun. 2004), pp. 36-
38.
Audit Booklet (Aug.
2003), pp. 24-27.
Information Security
Booklet (Jul. 2006) pp.
76-78.
FCA Essential Practices for Information Technology SPR - 3
Service Provider and Service Receiver Section