MADISON, Wis.-Credit unions and vendors alike now have a detailed guide to the due diligence process thanks to nine months of work by a task force put together by CUNA.
Credit union CEOs, NCUA staffers, state regulators and vendor representatives worked together on the new guide to not only help credit unions meet regulator requirements in vendor selection, but also to conduct business more efficiently as the guide includes a number of best practices.
"This guide that we've produced is a compilation of all the best thoughts of a wide range of people, and we think it is something credit unions can use every day to assure themselves that their vendor management achieves all their objectives," said task force chairman and SAFE CU CEO Henry Wirz. "It creates a well documented and understood process that allows both vendors and credit unions to effectively communicate with each other."
The guide is divided into three sections: Risk assessment and planning, due diligence and risk measurement and control. It also spells out the differences between critical and non-critical vendors and how to approach both.
Wirz pointed out that vendors who deal with member information must be especially scrutinized for security.
"This is a significant concern these days with compromises being reported every day," he said, noting that today's security risks go beyond protection from hackers. "You want to make sure that vendor has financial stability so they can continue to offer those services. The credit union has to do enough work in their due diligence process to ensure that there is continuity; that they have a fallback position that will continue member services" even if that vendor goes out of business.
Vice chairman Bill Raker, who is also CEO of US Federal Credit Union, said the $766-million institution used a number of the guide's recommendations and tips as it was being crafted and received a "very good review" in a recent examination.
"It's a great tool for credit unions on how to gather and organize the data that goes into doing their risk assessment in selecting a vendor," he added, noting that the guide does not provide a formula or substitute for local decisioning. "(The guide) does not preclude or take away the credit union's responsibility for making its own judgment and its own decision on what risk levels to assume and what is appropriate for its strategic plan."
Wirz said he believes the guide will provide a "double benefit" in helping both parties prepare for and execute the due diligence process as well as "raising the bar in how we serve our members."
For more info: www.cuna.org.
