Vendor Management: One Size No Longer Fits All
Based on what we've been seeing and hearing out in the field, the examiners aren't letting anyone phone this one in any more. Our existing approach satisfied the core requirements to be certain, but there were certain elements that no longer appeared as relevant, and there were others that needed to be added. All in all this is business as usual, as we're always working on keeping our services current.
But what's presented itself as more of a challenge this time around is how our solution fits into the client environment. While we've never sold a one-size-fits-all solution, we also never needed to go to any great lengths to customize our approach to match the institution's profile. However with the increased scrutiny being placed upon Vendor Management programs, there's greater pressure to make sure the policy and procedure both address their needs and present themselves as manageable solutions. If there's a field that requires a value on a form template, then the institution needs to fill that in. Leaving it blank or providing a static answer could raise concerns during the exam. We need to make sure that our solution allows the client to decide what needs to be included, understand how to determine the appropriate value/answer and then update the program to accommodate.
The examiners aren't letting anyone phone this one in any more.
Gone are the days where you can buy a solution as-is, run a series of change-alls to make it appear as if though it's unique, distribute it internally and consider yourself compliant. These programs, policies and procedures need to work, they need to address the risks they were intended to, and they need to be solutions that the institution can adequately support.
Try and answer the following questions:
- How frequently do we review vendor contracts?
- Do we distinguish vendors based on criticality?
- What's included in the contract?
- Do we have a list of what's supposed to be included in the contract?
- How many contracts are currently in-force and active?
If you can't answer all of these questions easily, you need to figure out why that is. You'll also need to figure out how to change the way vendors are managed by your institution, so that the answers are readily available. Because whether you take my advice or you wait for the examiners to weigh in, you're going to need to answer these questions.