About Us | Contact Us
View Cart

Financial Statement Review in Vendor Management

By Dan Hadaway | Monday, March 13, 2017 - 3 Comments

What are the expectations for Financial Statement Review?


For banks and credit unions.
Another one of those Dan’s New Leaf Posts, meant to inspire thought about IT Governance . . . .


I’m often asked, “what should we be doing when it comes to financial statement review during vendor management.”

Let me start off by establishing that I’m not a CPA, and all the other standard disclaimers about infotex not being financial. However, what I’ve heard both the OCC and FDIC say that banks should have a credit analyst review the financial statement and, if there is a risk, consider that during vendor due diligence.  I interpret that to mean that you might need to monitor vendors that represent a high degree of availability risk and that have financial issues. I have actually seen one OCC examiner state, in more than one bank, “would you loan money to this provider?”  I even saw one OCC examiner make a two-location bank review Google’s financial statements.  I thought that was an overkill, and actually suggested to the examiner that there are some vendors where financial statement review doesn’t make sense.  I include Google in this because they have a billion dollars sitting in the bank.  But I also include the OCC themselves in this.  The OCC is, in fact, a third party receiving very confidential information.  And I don’t know many banks that would loan money to the federal government.

But I digress . . .

When we audit a Client, given that we’re not financial, we simply make sure the credit analyst or any other person with financial analyst credentials is involved in this part of your vendor management program and that they have a method to their madness. For smaller banks, I don’t think the method needs to be documented, as long as you can show your examiners the actual Workpapers from the analyst’s review.  This will allow flexibility in your approach . . . for Google, you download the statements, check off that yes, they are continuing to make lots of money, and move on.  But for those smaller vendors where a financial statement review DOES make sense, I would expect a more thorough examination as well as documentation of the analysis process and results . . . in the form of Workpapers.

Some of our Clients ask where on boilerplates.infotex.com they can find templates for financial statement risk statements.  Again, given our limited competency in financials, we have no templates.

I would say, however, that we usually expect to see, at a minimum, the following for each vendor that represents a high degree of risk from a financial viability perspective:

  • Vendor Name, Contact, Etc.
  • Inherent Availability Risk (critical, high) <– I’d put “moderate and low” but I personally don’t think you should have to review the statements of vendors representing moderate or low availability risk
  • Inherent Security Risk (critical) <– I’d put high, moderate, & low, but I personally don’t think a bank your size should have to review statements of vendors representing high, moderate, or low-security risk. But if you have a vendor that possesses information, there is a risk if they are in bad financial shape, controls could be unenforced, and/or employees could be tempted to steal information because they’re not getting paid.
  • Who did the review
  • Date of the review
  • Issues: a summary of any issues found.
  • Conclusion: how would you risk rank the vendor? High, Moderate, Low (from a financial continuity perspective)

Finally, if you have a vendor who refuses to submit financial statements, but they represent critical or high availability risk (or critical security risk) inherently, consider placing a “google alert” on their company so that you can see any reports related to their financial condition.  We have been doing this for several of our own vendors for a few years now, and we find this to be sufficient in the eyes of our own auditors and examiners.

 


Dan’s New Leaf is a fun blog to inspire thought in the area of IT Governance.


same_strip_012513


 

3 Responses to “Financial Statement Review in Vendor Management”

Comment from Hosted PBX Dallas
Time 12/16/2018 at 10:08 am

Nice blog. I would like to share it with my friends. I hope you will continue your works like this. Keep up the excellent work. You have a magical talent of holding readers mind. It is something special which cant be given to everyone.

Hosted PBX Dallas

Comment from Accounts Receivable Factoring
Time 01/21/2019 at 2:28 am

Very good blog. An easy way to explain the cloud service. Example, given comparison is very helpful. It also explains what the service of choice is based on different types of needs. Thanks for writing such a blog.

Accounts Receivable Factoring

Comment from Accounts Receivable Factoring
Time 01/24/2019 at 5:20 pm

I’m just newbie to weblog and I really like this website. Almost certainly I would like to bookmark your blog post. You actually come up with extraordinary writing. Thank you for sharing your website.

Accounts Receivable Factoring

Latest News
    How Do We Know What We Know? Making Sure You Can Understand What Happened in an Incident. Another one of those Dan’s New Leaf Posts, meant to inspire thought about IT Governance . . . . Until I reclined on my front yard, looking at the sky, following the instructions on how not to look […]
    Another awareness poster for YOUR customers (and users).  Now that we have our own employees aware, maybe it’s time to start posting content for our customers! Download the large versions here: Awareness Poster (Portrait) Awareness Poster (Landscape)   You are welcome to print out and distribute this around your office. Interested in one of ours […]
    President Biden recently signed a bill tasking the agency with evaluating the unique risks that schools face… An article review. Taking note of the unique challenges educational institutions face in securing their networks, President Biden has signed a bill into law directing the Cybersecurity and Infrastructure Security Agency (CISA) to look into ways that they can […]
    Thanks for being interested in our Technology Planning Webinars! This year‘s annual update to our annual Technology Planning webinar will include a panel discussion, a review of the previous years’ movies that are already available, and a discussion about alternative tactics that have arisen from recent conferences as well as the impact of the AIO […]
    Welcome Cybersecurity Conference Attendees! Thanks for joining us for the Cybersecurity Conference today! We have created this page for you to have access to the deliverables from Dan’s talk.  
    What you need to know for compliance coast-to-coast. Back in 2020 we posted an article containing links to data breach laws from each state, and it has proven to be one of our more popular posts.  Because laws surrounding the use (and abuse) of technology are always evolving, we thought it was worth taking another […]
    Why It Rhymes With SEEM (And its Not the I Before E Rule) Another one of those Dan’s New Leaf Posts, meant to inspire thought about IT Governance . . . . It’s the Gestalt. The idea that the whole is greater than the sum of it’s parts. That’s not something that is often brought […]
    Another awareness poster for YOUR customers (and users).  Now that we have our own employees aware, maybe it’s time to start posting content for our customers! Download the large versions here: Awareness Poster (Portrait) Awareness Poster (Landscape)   You are welcome to print out and distribute this around your office. Interested in one of ours […]
    Questions about China’s new disclosure laws only highlight the uncertainty about disclosure in general… An article review. China recently made waves in the security world by announcing a new set of data security laws, one of which has added new fuel to a long running debate: how and when should security vulnerabilities be disclosed…and to […]