About Us | Contact Us
View Cart

Financial Statement Review in Vendor Management

By Dan Hadaway | Monday, March 13, 2017 - 3 Comments

What are the expectations for Financial Statement Review?


For banks and credit unions.
Another one of those Dan’s New Leaf Posts, meant to inspire thought about IT Governance . . . .


I’m often asked, “what should we be doing when it comes to financial statement review during vendor management.”

Let me start off by establishing that I’m not a CPA, and all the other standard disclaimers about infotex not being financial. However, what I’ve heard both the OCC and FDIC say that banks should have a credit analyst review the financial statement and, if there is a risk, consider that during vendor due diligence.  I interpret that to mean that you might need to monitor vendors that represent a high degree of availability risk and that have financial issues. I have actually seen one OCC examiner state, in more than one bank, “would you loan money to this provider?”  I even saw one OCC examiner make a two-location bank review Google’s financial statements.  I thought that was an overkill, and actually suggested to the examiner that there are some vendors where financial statement review doesn’t make sense.  I include Google in this because they have a billion dollars sitting in the bank.  But I also include the OCC themselves in this.  The OCC is, in fact, a third party receiving very confidential information.  And I don’t know many banks that would loan money to the federal government.

But I digress . . .

When we audit a Client, given that we’re not financial, we simply make sure the credit analyst or any other person with financial analyst credentials is involved in this part of your vendor management program and that they have a method to their madness. For smaller banks, I don’t think the method needs to be documented, as long as you can show your examiners the actual Workpapers from the analyst’s review.  This will allow flexibility in your approach . . . for Google, you download the statements, check off that yes, they are continuing to make lots of money, and move on.  But for those smaller vendors where a financial statement review DOES make sense, I would expect a more thorough examination as well as documentation of the analysis process and results . . . in the form of Workpapers.

Some of our Clients ask where on boilerplates.infotex.com they can find templates for financial statement risk statements.  Again, given our limited competency in financials, we have no templates.

I would say, however, that we usually expect to see, at a minimum, the following for each vendor that represents a high degree of risk from a financial viability perspective:

  • Vendor Name, Contact, Etc.
  • Inherent Availability Risk (critical, high) <– I’d put “moderate and low” but I personally don’t think you should have to review the statements of vendors representing moderate or low availability risk
  • Inherent Security Risk (critical) <– I’d put high, moderate, & low, but I personally don’t think a bank your size should have to review statements of vendors representing high, moderate, or low-security risk. But if you have a vendor that possesses information, there is a risk if they are in bad financial shape, controls could be unenforced, and/or employees could be tempted to steal information because they’re not getting paid.
  • Who did the review
  • Date of the review
  • Issues: a summary of any issues found.
  • Conclusion: how would you risk rank the vendor? High, Moderate, Low (from a financial continuity perspective)

Finally, if you have a vendor who refuses to submit financial statements, but they represent critical or high availability risk (or critical security risk) inherently, consider placing a “google alert” on their company so that you can see any reports related to their financial condition.  We have been doing this for several of our own vendors for a few years now, and we find this to be sufficient in the eyes of our own auditors and examiners.

 


Dan’s New Leaf is a fun blog to inspire thought in the area of IT Governance.


same_strip_012513


 

3 Responses to “Financial Statement Review in Vendor Management”

Comment from Hosted PBX Dallas
Time 12/16/2018 at 10:08 am

Nice blog. I would like to share it with my friends. I hope you will continue your works like this. Keep up the excellent work. You have a magical talent of holding readers mind. It is something special which cant be given to everyone.

Hosted PBX Dallas

Comment from Accounts Receivable Factoring
Time 01/21/2019 at 2:28 am

Very good blog. An easy way to explain the cloud service. Example, given comparison is very helpful. It also explains what the service of choice is based on different types of needs. Thanks for writing such a blog.

Accounts Receivable Factoring

Comment from Accounts Receivable Factoring
Time 01/24/2019 at 5:20 pm

I’m just newbie to weblog and I really like this website. Almost certainly I would like to bookmark your blog post. You actually come up with extraordinary writing. Thank you for sharing your website.

Accounts Receivable Factoring

Latest News
    R7: 2023’s Top Seven Technology Risks Webinar-Video What are the top seven risks your board should know about in 2023? Since 2006, Dan has been compiling a list of the “top seven risks small institutions are facing,” in preparation for his board presentations. This webinar will present the 2023 list in a manner that you […]
    PRESS RELEASE – FOR IMMEDIATE RELEASE BUSINESS NEWS NEW EMPLOYEE FOR INFOTEX We are excited to announce the addition of William Summers to our team as our new Data Security Analyst. William brings a wealth of knowledge to our organization, and we are confident that he will be an invaluable asset in helping us reach […]
    Yes, the CISO of the Starship Enterprise On AI replacing the business of cybersecurity. Another one of those Dan’s New Leaf Posts, meant to inspire thought about IT Governance . . . . From time to time, my friends from high school, and even some from college, who have a minimal understanding of the cybersecurity […]
    Artificial intelligence carries risk, but so does organic ignorance … Another one of those Dan’s New Leaf Posts, meant to inspire thought about IT Governance . . . . At a recent conference, I noticed two camps emerging in the debate over artificial intelligence. Some people embrace AI as a tool, while others support Elon […]
    PRESS RELEASE – FOR IMMEDIATE RELEASE BUSINESS NEWS NEW EMPLOYEE FOR INFOTEX We are pleased to announce the appointment of Nathan Taylor as our new Network Administrator at infotex.  “We are very excited to have Nathan join our team as a Network Administrator and look forward to his contributions to maintaining and improving our infrastructure!” […]
    about artificial intelligence . . . And who will protect us from it . . .  Another one of those Dan’s New Leaf Posts, meant to inspire thought about IT Governance . . . . Just watched some press on the the Senate hearings over regulating AI. The normal senator faces, Sam Altman of OpenAI, […]
    The Evolution of an Inside Term Used in our Vendor Risk Report Another one of those Dan’s New Leaf Posts, meant to inspire thought about IT Governance . . . . Those who audit infotex know that our vendor risk report refers to a couple of our providers as “ransomware companies.” This reference started evolving […]
    Another awareness poster for YOUR customers (and users). Now that we have our own employees aware, maybe it’s time to start posting content for our customers! Check out posters.infotex.com for the whole collection! Download the large versions here: Awareness Poster (Portrait) Awareness Poster (Landscape) You are welcome to print out and distribute this around your […]
    New tools could allow unskilled attackers to launch increasingly sophisticated attacks… An article review. Imagine a world where you receive a call from your boss asking you to assist them with something… only it’s not your boss, but an AI being used by an attacker.  This isn’t science fiction, it’s an actual attack that has […]
    Unavailability Strikes Where it doesn’t matter anyway Another one of those Dan’s New Leaf Posts, meant to inspire thought about IT Governance . . . . So, I’m writing today’s article from a resort in the middle of Wisconsin.  I want to make sure I’m staying on top of my New Leaf, which is to […]