The FDIC reported on the risks for financial institutions that contract with technology service providers.
Financial institution boards of directors and senior management are responsible for overseeing risks with respect to relationships with technology service providers. The FDIC highlighted that recent examinations found that certain contracts with technology service providers lacked adequate detail relating to the contract parties' "rights and responsibilities" for "business continuity and incident response." The FDIC stated that financial institutions "remain responsible for assessing those risks and implementing appropriate mitigating controls."
Commentary / Vivian Maese
Financial institutions rely on outsourcing to third parties' technologies for the performance of material operations. It is incumbent upon financial institutions to not only assure that the contracts are sufficient at signing, but also that there are procedures in place that allow the institutions to regularly monitor contract performance and the stability of service providers. That would enable institutions to continue in operation in the event of a failure of service providers, whether under contract or generally.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.