CUNAs Due Diligence Taskforce

1
CUNAsDue Diligence Taskforce

• (Vendor Relationship Management)
• Bill Raker
• Taskforce Vice Chair

2
Due Diligence -- WHY?

• Regulatory Requirement

3
Due Diligence WHY?

• Regulatory Requirement
• Disaster Avoidance
• Stories that made us shudder
• CU failures
• Reputation loss
• Job loss

4
Taskforce Purpose

• Assist credit unions with due diligence
  responsibilities with third-party vendors without
  duplication of effort

5
Taskforce Purpose

• Assist credit unions with due diligence
  responsibilities with third-party vendors without
  duplication of effort
• Provide practical resources model procedures
  for assessing, controlling, and monitoring risks
  associated with third-party agreements and
  performance

6
Taskforce Purpose

• Assist credit unions with due diligence
  responsibilities with third-party vendors without
  duplication of effort
• Provide practical resources model procedures
  for assessing, controlling, and monitoring risks
  associated with third-party agreements and
  performance
• Provide mechanism for credit unions to
  communicate concerns about due diligence
  requirements to CUNA so concerns can be discussed
  with regulators

7
Taskforce Purpose

• Assist credit unions with due diligence
  responsibilities with third-party vendors without
  duplication of effort
• Provide practical resources model procedures
  for assessing, controlling, and monitoring risks
  associated with third-party agreements and
  performance
• Provide mechanism for credit unions to
  communicate concerns about due diligence
  requirements to CUNA so concerns can be discussed
  with regulators
• Facilitate a consistent standardized approach for
  efficiency and minimization of redundancy and
  overlap

8
Taskforce

• 19 members from diverse backgrounds and
  perspectives
• 9 CUNA staff support
• Meetings to date 1 in person 3 via phone
• 3 Subgroups (1 phone meeting each)
• Core Standards
• Best Practices
• Vendor Template/Certification Process

9
Due Diligence

• Process related to business decision to select,
  implement monitor third-party business
  relationship
• Three Parts
• Strategic Planning Risk Assessment
• Appropriateness feasibility
• Consider NCUAs 7 Risk Categories
• Obtaining analyzing information about
  third-parties
• Due Diligence
• On-going performance management monitoring

10
Business Risk Assessment

• Process of making business decision

11
Business Risk Assessment

• Process of making business decision
• Best Practices or examples procedures

12
Business Risk Assessment

• Process of making business decision
• Best Practices or examples procedures
• Independent decision based on credit unions own
  circumstances

13
Business Risk Assessment

• Process of making business decision
• Best Practices or examples procedures
• Independent decision based on credit unions own
  circumstances
• Completed prior to vendor selection

14
Completed Activities

• Met with NCUA representative
• Developed a Website
• Hosted an audio conference
• Identified compendium of reference documents and
  materials
• Drafted an outline for Credit Union Guide for
  Vendor Relationship Management
• Developed a proposed timeline for task completion

15
Planned Activities

• Meet with other regulators agencies
• Survey CUNA Councils
• Review the role of CUNA and league endorsements
• Engage Expert review of deliverables prior to
  release

16
Core Practices (Standards)

• NCUA and other requirements
• Standard approach to vendor type and vendor
  criticality
• Standard definitions
• What essential information to gather, review and
  analyze

17
Best Practices

• Relativity of vendor criticality to each credit
  unions circumstances standard ways to assess
• How to obtain and analyze essential data
• Provide examples of policies, risk assessment
  tools, business plans, vendor questionnaires,
  checklists

18
Vendor Template/Certification

• Certification can have multiple meanings
• What is appropriate for our situation?
• Ways to share due diligence information
• Templates to facilitate the process of
• Assessing risks
• Making business decision (Business Plan)
• Collecting vendor data
• Evaluating options
• Negotiating contracts
• Monitoring performance

19
Anticipated Deliverables

• Credit Union Guide for Vendor Relationship
  Management
• Also considering a supplemental guide specific to
  small credit unions
• Efforts to have Boards and Supervisory Committees
  become more aware of their responsibilities
• Standardized Model/Template for vendors to use to
  reduce duplication of efforts

20
Timeline

• July
• Call with staff Subgroup Chairs

21
Timeline

• July
• Call with staff Subgroup Chairs
• August
• Draft of Comprehensive Outline
• Review Outline with Taskforce

22
Timeline

• July
• Call with staff Subgroup Chairs
• August
• Draft of Comprehensive Outline
• Review Outline with Taskforce
• September
• Straw Man draft of Guidebook
• Taskforce review, refinement and approval

23
Timeline

• July
• Call with staff Subgroup Chairs
• August
• Draft of Comprehensive Outline
• Review Outline with Taskforce
• September
• Straw Man draft of Guidebook
• Taskforce review, refinement and approval
• October
• Deliverables (Guidebook) ready

24
Taskforce Website

• http//www.cuna.org/initiatives/due_diligence.html

25
Google

• Due Diligence
• 10,500,000 reference sites!
• Vendor Management
• 6,210,000 reference sites!
• Vendor Management Blogs
• 420,000 reference sites!

26
Now For An Example

• Real Life