Examination Experience Survey – preliminary results
Although the survey is still open, I wanted to discuss one particular trend that I find interesting. (If you’ve already participated, thank you! Please pass the link on to a …
Read the rest of the article
FDIC Institutions getting more UIGEA (Reg GG) findings – UPDATE 2
Updated 12/5/2011 to add examination procedures*.
Updated again 2/13/2012 to emphasize policy requirements.
We first saw this trend back in July 2011, and continue to see it, so I’m calling …
Read the rest of the article
BCP plans continue to draw criticism
In a recent FDIC IT Examination, the examiner made the following criticism of the institutions’ DR/BCP:
“Business continuity planing should focus on all critical business functions that need to be…
Read the rest of the article
Audits vs. Examinations
As I speak with those in financial institutions responsible for responding to audit and examination requests, I find that there is considerable confusion over the differences between the two. And …
Read the rest of the article
SAR Filings – Computer Intrusion vs. Identity Theft
The Financial Crimes Enforcement Network (FinCEN) publishes a statistical summary and review of all suspicious activity report (SAR) filings a couple of times per year. The latest one …
Read the rest of the article
The IT Strategic Plan – Why, Who, & How
One of the most common examination findings recently (particularly with the FDIC) has been the lack of an IT Strategic Plan. I’m not sure why the focus lately (perhaps the …
Read the rest of the article
Using Technology to Drive Compliance
In the past year to year and a half, nearly all of the IT examination findings I’ve seen have in the broad category of “documentation”, or more specifically, lack thereof. …
Read the rest of the article
“Concentration of duties”
It is not unusual for a community financial institution with limited personnel to have the Information Security Officer (ISO) act as a backup network administrator. In fact, this is a …
Read the rest of the article
The Control Self-Assessment (CSA)
If there was a process that was mentioned 43 times in 7 of the 12 FFIEC IT Examination Handbooks, (including 12 times in the Information Security Handbook alone!), would you …
Read the rest of the article
IT Composite Ratings: 1 vs. 2
In a recent survey conducted with our customers, we asked them to tell us (anonymously) what their FDIC IT composite scores were after their last IT examination, and whether those …
Read the rest of the article
