Contents
What should the OCC expect from third party relationships?
Therefore, the OCC expects more comprehensive and rigorous oversight and management of third-party relationships that involve critical activities—significant bank functions (e.g., payments, clearing, settlements, custody) or significant shared services (e.g., information technology), or other activities that
Who is in charge of open source compliance?
The OSRB is in charge of creating an open source compliance strategy and a set of processes that determine how a company will implement these rules on a daily basis. The strategy establishes what must be done to ensure compliance and offers a governing set of principles for how employees interact with open source software.
When do you need to do due diligence on a third party?
The degree of due diligence should be commensurate with the level of risk and complexity of the third-party relationship. More extensive due diligence is necessary when a third-party relationship involves critical activities. On-site visits may be useful to understand fully the third party’s operations and capacity.
How to evaluate a third party risk management program?
Risk Management. Evaluate the effectiveness of the third party’s risk management program, including policies, processes, and internal controls. Where applicable, determine whether the third party’s internal audit function independently and effectively tests and reports on the third party’s internal controls.
What do you need to know about vendor lifecycle management?
Next, organizations must supply vendor report reviews proving ongoing governance throughout the vendor lifecycle. What is vendor lifecycle management? Traditionally, vendor lifecycle management incorporates five primary categories: qualifying, engagement, managing delivery, managing finances, and relationship termination.
What does it mean to have a third party relationship?
A third-party relationship is any business arrangement between a bank and another entity, by contract or otherwise. 1. The Office of the Comptroller of the Currency (OCC) expects a bank to practice effective risk management regardless of whether the bank performs the activity internally or through a third party.
How does third party relationship affect bank risk?
Third-party relationships may increase a bank’s exposure to operational risk because the bank may not have direct control of the activity performed by the third party. Operational risk can increase significantly when third-party relationships result in concentrations.