About Us | Contact Us
View Cart

Financial Statement Review in Vendor Management

By Dan Hadaway | Monday, March 13, 2017 - 3 Comments

What are the expectations for Financial Statement Review?


For banks and credit unions.
Another one of those Dan’s New Leaf Posts, meant to inspire thought about IT Governance . . . .


I’m often asked, “what should we be doing when it comes to financial statement review during vendor management.”

Let me start off by establishing that I’m not a CPA, and all the other standard disclaimers about infotex not being financial. However, what I’ve heard both the OCC and FDIC say that banks should have a credit analyst review the financial statement and, if there is a risk, consider that during vendor due diligence.  I interpret that to mean that you might need to monitor vendors that represent a high degree of availability risk and that have financial issues. I have actually seen one OCC examiner state, in more than one bank, “would you loan money to this provider?”  I even saw one OCC examiner make a two-location bank review Google’s financial statements.  I thought that was an overkill, and actually suggested to the examiner that there are some vendors where financial statement review doesn’t make sense.  I include Google in this because they have a billion dollars sitting in the bank.  But I also include the OCC themselves in this.  The OCC is, in fact, a third party receiving very confidential information.  And I don’t know many banks that would loan money to the federal government.

But I digress . . .

When we audit a Client, given that we’re not financial, we simply make sure the credit analyst or any other person with financial analyst credentials is involved in this part of your vendor management program and that they have a method to their madness. For smaller banks, I don’t think the method needs to be documented, as long as you can show your examiners the actual Workpapers from the analyst’s review.  This will allow flexibility in your approach . . . for Google, you download the statements, check off that yes, they are continuing to make lots of money, and move on.  But for those smaller vendors where a financial statement review DOES make sense, I would expect a more thorough examination as well as documentation of the analysis process and results . . . in the form of Workpapers.

Some of our Clients ask where on boilerplates.infotex.com they can find templates for financial statement risk statements.  Again, given our limited competency in financials, we have no templates.

I would say, however, that we usually expect to see, at a minimum, the following for each vendor that represents a high degree of risk from a financial viability perspective:

  • Vendor Name, Contact, Etc.
  • Inherent Availability Risk (critical, high) <– I’d put “moderate and low” but I personally don’t think you should have to review the statements of vendors representing moderate or low availability risk
  • Inherent Security Risk (critical) <– I’d put high, moderate, & low, but I personally don’t think a bank your size should have to review statements of vendors representing high, moderate, or low-security risk. But if you have a vendor that possesses information, there is a risk if they are in bad financial shape, controls could be unenforced, and/or employees could be tempted to steal information because they’re not getting paid.
  • Who did the review
  • Date of the review
  • Issues: a summary of any issues found.
  • Conclusion: how would you risk rank the vendor? High, Moderate, Low (from a financial continuity perspective)

Finally, if you have a vendor who refuses to submit financial statements, but they represent critical or high availability risk (or critical security risk) inherently, consider placing a “google alert” on their company so that you can see any reports related to their financial condition.  We have been doing this for several of our own vendors for a few years now, and we find this to be sufficient in the eyes of our own auditors and examiners.

 


Dan’s New Leaf is a fun blog to inspire thought in the area of IT Governance.


same_strip_012513


 

3 Responses to “Financial Statement Review in Vendor Management”

Comment from Hosted PBX Dallas
Time 12/16/2018 at 10:08 am

Nice blog. I would like to share it with my friends. I hope you will continue your works like this. Keep up the excellent work. You have a magical talent of holding readers mind. It is something special which cant be given to everyone.

Hosted PBX Dallas

Comment from Accounts Receivable Factoring
Time 01/21/2019 at 2:28 am

Very good blog. An easy way to explain the cloud service. Example, given comparison is very helpful. It also explains what the service of choice is based on different types of needs. Thanks for writing such a blog.

Accounts Receivable Factoring

Comment from Accounts Receivable Factoring
Time 01/24/2019 at 5:20 pm

I’m just newbie to weblog and I really like this website. Almost certainly I would like to bookmark your blog post. You actually come up with extraordinary writing. Thank you for sharing your website.

Accounts Receivable Factoring

Latest News
    A Webinar Movie This presentation is intended for those who are planning to participate in an infotex incident response test. Please let us know what questions you have, when we have our Plan Walkthrough and Test Plan Approval meeting!
    What you need to know for compliance coast-to-coast. Back in 2020 we posted an article containing links to data breach laws from each state, and it has proven to be one of our more popular posts.  Because laws surrounding the use (and abuse) of technology are always evolving, we thought it was worth taking another […]
    Another awareness poster for YOUR customers (and users).  Now that we have our own employees aware, maybe it’s time to start posting content for our customers! In the spirit of October and Halloween we have put together a gallery of our “spooky” Awareness Posters at halloween.infotex.com. Use them to help decorate for the holiday! Check […]
    With nearly three in four people using third-party payment services tied to their bank accounts, the risk isn’t limited to your own policies and procedures… An article review. When working on cybersecurity awareness messages for your customers you may be inclined to focus on your own systems, but a new study on security in digital […]
    PRESS RELEASE – FOR IMMEDIATE RELEASE BUSINESS NEWS NEW EMPLOYEE FOR INFOTEX infotex is excited to announce that Cody Smith has joined the team as the newest Data Security Analyst. Cody holds several industry certifications (including the most recent: SSCP) as well as a B.S in Cyber Security & Information Assurance from Western Governors University. […]
    It’s all about protecting Customer information . . . In 1999 the Gramm-Leach-Bliley Act (GLBA) directed the Federal Deposit Insurance Corporation (FDIC) and other federal banking agencies to ensure that financial institutions have policies, procedures, and controls in place to prevent the unauthorized disclosure of customer financial information.  The FDIC and other federal banking agencies […]
    A Ghoulish Gallery! Just a few scary-themed Awareness posters from our collection, which you can see at posters.infotex.com! Below you will find both the vertical and horizontal versions of each of the posters, all you need to do is “right-click > “Save link as…” to download! Vertical 8.5″ x 11″ Format   Horizontal 11″ x […]
    What to Expect in an Annual Information Security Report to the Board Webinar-Movie Information security ranks as a top risk to financial institutions, both in terms of likelihood and overall impact. It is important that boards receive annual comprehensive reporting from management about the information security risks and incidents, and the actions taken to address […]
    Another awareness poster for YOUR customers (and users).  Now that we have our own employees aware, maybe it’s time to start posting content for our customers! Check out posters.infotex.com for the whole collection! Download the large versions here: Awareness Poster (Portrait) Awareness Poster (Landscape)   You are welcome to print out and distribute this around […]
    With the potential to break all existing forms of encryption, quantum computing poses a unique challenge… An article review. While quantum computing has been a buzzword for some time now the technology remains largely theoretical, with small scale proofs-of-concept that still suffer from serious limitations.  That hasn’t stopped security researchers from worrying about the technology’s […]