About Us | Contact Us
View Cart

Financial Statement Review in Vendor Management

By Dan Hadaway | Monday, March 13, 2017 - 3 Comments

What are the expectations for Financial Statement Review?


For banks and credit unions.
Another one of those Dan’s New Leaf Posts, meant to inspire thought about IT Governance . . . .


I’m often asked, “what should we be doing when it comes to financial statement review during vendor management.”

Let me start off by establishing that I’m not a CPA, and all the other standard disclaimers about infotex not being financial. However, what I’ve heard both the OCC and FDIC say that banks should have a credit analyst review the financial statement and, if there is a risk, consider that during vendor due diligence.  I interpret that to mean that you might need to monitor vendors that represent a high degree of availability risk and that have financial issues. I have actually seen one OCC examiner state, in more than one bank, “would you loan money to this provider?”  I even saw one OCC examiner make a two-location bank review Google’s financial statements.  I thought that was an overkill, and actually suggested to the examiner that there are some vendors where financial statement review doesn’t make sense.  I include Google in this because they have a billion dollars sitting in the bank.  But I also include the OCC themselves in this.  The OCC is, in fact, a third party receiving very confidential information.  And I don’t know many banks that would loan money to the federal government.

But I digress . . .

When we audit a Client, given that we’re not financial, we simply make sure the credit analyst or any other person with financial analyst credentials is involved in this part of your vendor management program and that they have a method to their madness. For smaller banks, I don’t think the method needs to be documented, as long as you can show your examiners the actual Workpapers from the analyst’s review.  This will allow flexibility in your approach . . . for Google, you download the statements, check off that yes, they are continuing to make lots of money, and move on.  But for those smaller vendors where a financial statement review DOES make sense, I would expect a more thorough examination as well as documentation of the analysis process and results . . . in the form of Workpapers.

Some of our Clients ask where on boilerplates.infotex.com they can find templates for financial statement risk statements.  Again, given our limited competency in financials, we have no templates.

I would say, however, that we usually expect to see, at a minimum, the following for each vendor that represents a high degree of risk from a financial viability perspective:

  • Vendor Name, Contact, Etc.
  • Inherent Availability Risk (critical, high) <– I’d put “moderate and low” but I personally don’t think you should have to review the statements of vendors representing moderate or low availability risk
  • Inherent Security Risk (critical) <– I’d put high, moderate, & low, but I personally don’t think a bank your size should have to review statements of vendors representing high, moderate, or low-security risk. But if you have a vendor that possesses information, there is a risk if they are in bad financial shape, controls could be unenforced, and/or employees could be tempted to steal information because they’re not getting paid.
  • Who did the review
  • Date of the review
  • Issues: a summary of any issues found.
  • Conclusion: how would you risk rank the vendor? High, Moderate, Low (from a financial continuity perspective)

Finally, if you have a vendor who refuses to submit financial statements, but they represent critical or high availability risk (or critical security risk) inherently, consider placing a “google alert” on their company so that you can see any reports related to their financial condition.  We have been doing this for several of our own vendors for a few years now, and we find this to be sufficient in the eyes of our own auditors and examiners.

 


Dan’s New Leaf is a fun blog to inspire thought in the area of IT Governance.


same_strip_012513


 

3 Responses to “Financial Statement Review in Vendor Management”

Comment from Hosted PBX Dallas
Time 12/16/2018 at 10:08 am

Nice blog. I would like to share it with my friends. I hope you will continue your works like this. Keep up the excellent work. You have a magical talent of holding readers mind. It is something special which cant be given to everyone.

Hosted PBX Dallas

Comment from Accounts Receivable Factoring
Time 01/21/2019 at 2:28 am

Very good blog. An easy way to explain the cloud service. Example, given comparison is very helpful. It also explains what the service of choice is based on different types of needs. Thanks for writing such a blog.

Accounts Receivable Factoring

Comment from Accounts Receivable Factoring
Time 01/24/2019 at 5:20 pm

I’m just newbie to weblog and I really like this website. Almost certainly I would like to bookmark your blog post. You actually come up with extraordinary writing. Thank you for sharing your website.

Accounts Receivable Factoring

Latest News
    The Four Basic Truths of System Security Webinar-Video The last thirty years have seen an evolution of frameworks, laws, and assessment approaches to information security which can intimidate the management team with their complexity. This webinar will discuss the four basic truths of system security regardless of frameworks or approach, and eight control systems to […]
    Community Banking and their layers of security. . . Michael Hartke’s first post as Executive Vice President! Thinking back to my first talk to security professionals in community banking almost 10 years ago, the question continues to this day. First some background… infotex was moderating the Indiana Bankers Association Security Conference when one of the […]
    Reasons why we should be considered! infotex provides a number of services that can be checked out if you click over to offerings.infotex.com! We even made a movie with all the reasons why infotex should be your next MSOC!  
    infotex and GoTo To all infotex managed security service Clients: As recently reported by major news outlets there was a data breach affecting GoTo (formerly LogMeIn) wherein attackers stole encrypted backups containing customer information in November 2022.  Based on the advisory from GoTo the products they offer that are affected include LogMeIn Pro, LogMeIn Central, […]
    An option for increasing security for ALL organizations. . . The threat landscape is evolving daily, and it is becoming increasingly difficult for even large organizations providing cyber defense services to keep up. As Brandao (2021) notes, it is important for organizations to adapt holistic technologies that can correlate all attack events. Therefore, developing XDR […]
    Another awareness poster for YOUR customers (and users).  Now that we have our own employees aware, maybe it’s time to start posting content for our customers! Check out posters.infotex.com for the whole collection! Download the large versions here: Awareness Poster (Portrait) Awareness Poster (Landscape) You are welcome to print out and distribute this around your […]
    A relic of the internet’s less secure past, many small firms struggle to secure their email systems… An article review. With a great deal of cybersecurity related news focused on new threats and similarly new techniques aimed at combating them, it can be easy to forget some of the older threats that have never gone […]
    Seven Trends . . . …that small bank Information Security Officers face in 2023 Another one of those Dan’s New Leaf Posts, meant to inspire thought about IT Governance . . . . Welcome to the Magnificent Seven, my annual predictive article about the seven trends in technology that will impact the Information Security Officers of […]
    System Security and Cybersecurity are not the same thing. . . Another one of those Dan’s New Leaf Posts, meant to inspire thought about IT Governance . . . . Regarding “information security,” the last thirty years have seen an evolution of frameworks, laws, and assessment approaches which intimidate the management team with their complexity.  […]
    The cryptographic algorithm is vulnerable to attack and is no longer considered secure… An article review. NIST has announced that it plans to retire the SHA-1 cryptographic algorithm by the end of 2030, citing multiple vulnerabilities in the standard, effectively ending its use after nearly 30 years.  Introduced in 1995, SHA-1 used a 160-bit hash […]