OCC to Heighten Tech Management Scrutiny

The Office of the Comptroller of the Currency is planning to increase its oversight of how banks manage technology.

Examiners will check whether executives understand how technology affects the bank and whether they follow internal controls intended to keep their computer systems running safely. At least one high-ranking executive should be expert in technology operations and oversight, the agency said in risk management guidelines released last week.

"The OCC's primary supervisory concern in reviewing a bank's use of technology is whether the bank is assuming a level of risk that exceeds its ability to manage and control the risk," the agency said.

Management also should make regular reports to directors about technology initiatives, the guidelines said. Directors, in turn, are expected to participate in the planning, evaluation, and implementation of new technologies.

The agency emphasized the need for national banks to scrutinize outside vendors closely to protect confidential customer information. Regular testing of the security and accuracy of data is necessary, the OCC said. "As banks increase their dependency on technology to deliver services and process information, the risk of adverse consequences from operational failures increases," the agency said.

It said it will release risk-management guidelines by the end of February on banking by personal computer. Guidelines on other products are expected this year.

Other regulators have been issuing electronic banking guidelines since last year. The Federal Reserve Board in early December issued guidelines on information security, and the Federal Deposit Insurance Corp. issued a paper that month on the risks related to Internet use. The Office of Thrift Supervision in October released examination guidelines for electronic banking.