What are the expectations for Financial Statement Review?

For banks and credit unions.
Another one of those Dan’s New Leaf Posts, meant to inspire thought about IT Governance . . . .

I’m often asked, “what should we be doing when it comes to financial statement review during vendor management.”

Let me start off by establishing that I’m not a CPA, and all the other standard disclaimers about infotex not being financial. However, what I’ve heard both the OCC and FDIC say that banks should have a credit analyst review the financial statement and, if there is a risk, consider that during vendor due diligence.  I interpret that to mean that you might need to monitor vendors that represent a high degree of availability risk and that have financial issues. I have actually seen one OCC examiner state, in more than one bank, “would you loan money to this provider?”  I even saw one OCC examiner make a two-location bank review Google’s financial statements.  I thought that was an overkill, and actually suggested to the examiner that there are some vendors where financial statement review doesn’t make sense.  I include Google in this because they have a billion dollars sitting in the bank.  But I also include the OCC themselves in this.  The OCC is, in fact, a third party receiving very confidential information.  And I don’t know many banks that would loan money to the federal government.

But I digress . . .

When we audit a Client, given that we’re not financial, we simply make sure the credit analyst or any other person with financial analyst credentials is involved in this part of your vendor management program and that they have a method to their madness. For smaller banks, I don’t think the method needs to be documented, as long as you can show your examiners the actual Workpapers from the analyst’s review.  This will allow flexibility in your approach . . . for Google, you download the statements, check off that yes, they are continuing to make lots of money, and move on.  But for those smaller vendors where a financial statement review DOES make sense, I would expect a more thorough examination as well as documentation of the analysis process and results . . . in the form of Workpapers.

Some of our Clients ask where on boilerplates.infotex.com they can find templates for financial statement risk statements.  Again, given our limited competency in financials, we have no templates.

I would say, however, that we usually expect to see, at a minimum, the following for each vendor that represents a high degree of risk from a financial viability perspective:

• Vendor Name, Contact, Etc.
• Inherent Availability Risk (critical, high) <– I’d put “moderate and low” but I personally don’t think you should have to review the statements of vendors representing moderate or low availability risk
• Inherent Security Risk (critical) <– I’d put high, moderate, & low, but I personally don’t think a bank your size should have to review statements of vendors representing high, moderate, or low-security risk. But if you have a vendor that possesses information, there is a risk if they are in bad financial shape, controls could be unenforced, and/or employees could be tempted to steal information because they’re not getting paid.
• Who did the review
• Date of the review
• Issues: a summary of any issues found.
• Conclusion: how would you risk rank the vendor? High, Moderate, Low (from a financial continuity perspective)

Finally, if you have a vendor who refuses to submit financial statements, but they represent critical or high availability risk (or critical security risk) inherently, consider placing a “google alert” on their company so that you can see any reports related to their financial condition.  We have been doing this for several of our own vendors for a few years now, and we find this to be sufficient in the eyes of our own auditors and examiners.

Dan’s New Leaf is a fun blog to inspire thought in the area of IT Governance.