Vendor Compliance Management Series: Where To Start?
by Sarah Harvey / May 29th, 2014
What’s Changed?
There needs to be a full chain of custody as the CFPB expects you to “oversee their business relationships with service providers in a manner that ensures compliance with Federal consumer financial law….” For example, if you have “any person (i.e. service provider) that provides a material service to a covered person (i.e. you) in connection with the offering or provision by such covered person of a consumer financial product or service,” then you are responsible for their compliance to all relevant CFPB requirements. In essence, both parties are responsible for upholding the requirements of the CFPB.
For your vendor compliance management program to meet these requirements, it will need to include the following required components:
- Due diligence in vendor selection and onboarding
- Ongoing risk assessment
- Contractual requirements
- Audit plan
- Monitoring
- Termination
- List of third parties to include a description of services performed
- Third party contracts
- Statement or Work or Service Level Agreements
- Third parties’ SOC 1 reports, PCI RoC, etc.
- Conduct a risk assessment
- Develop policies and procedures that define due diligence requirements according to risk ranking and services performed
- Develop policies and procedures that define due diligence requirements according to risk ranking and services performed
- Establish vendor compliance management policies, procedures, checklists, and templates
For more information about vendor compliance management, contact us today.
