Policies and procedures

Finally, a bank must have strong policies and procedures in place. The policies provide a framework for vendor management while the procedures provide for implementation. The policies should reflect the commitment of the board of directors to establish a culture of compliance with regulatory guidance. Regular reporting to the board should provide oversight by demonstrating that the procedures are effectively implementing the board’s policies.

Vendor management, as with every aspect of a bank’s risk management program, is essential to a safe and sound financial institution. The vendor management program should be established with appropriate reporting structures so that the senior management and the board of directors have the appropriate information necessary to control and monitor risks to the bank.  

Vendor management programs require constant supervision and oversight to remain effective. Automation should be considered wherever practical to maintain compliance. Third-party reviews of the program can also provide assistance in identifying weaknesses or holes in compliance, processes or procedures.