Source: http://compliance-edu.com/CEI-VS-DHG/
Timestamp: 2018-03-21 18:16:22
Document Index: 570394578

Matched Legal Cases: ['art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 2', 'art 2', 'art 2', 'art 2', 'art 2', 'art 2', 'art 2', 'art 3', 'art 3', 'art 3', 'art 3', 'art 3', 'art 3']

CEI vs DHG LLP & IIA - Compliance Education Institute
CEI vs DHG LLP & IIA	complianceWP	2018-03-15T10:14:53+00:00
CEI vs DHG LLP & IIA
Following is a comparison chart between the CRVPM course content and DHG LLP content that we allege to have been intentionally copied by Mike Blevins and Chris Ricchiuto of Dixon Hughes Goodman LLP’s Risk Practice that was used as the basis of and included in their 4 part Vendor Management Series. Each week we will release more of the 35 instances of plagiarized and near-plagiarized content.
Watch the list grow over the coming weeks. While we have filed our legal case in court, YOU BE THE JUDGE IN THE COURT OF PUBLIC OPINION!
While we are a small company in comparison to the defendants, we will not allow our legally protected content to be used without our knowledge nor our permission. We will aggressively enforce our legal rights and WE WILL NOT BE PUSHED AROUND!
DHG MISLEADING STATEMENT
CEI LLC v. DHG: Non-Exclusive Examples of Verbatim and Near-Verbatim Copying By DHG
CEI (Exhibits 1 through 8)
DHG & IIA (Exhibit 9)
1. Chp.2, Slide 5
Outsourcing: many institutions outsource business and technology functions to service providers who can offer “better, faster, cheaper” in order to improve operational cost efficiencies. However, outsourcing a function does not absolve the institution of its responsibility to ensure that controls are in place to protect data and systems. Part 1, Pg. 1, Paragraph 1
While outsourcing can create efficiencies for companies, it is also important to remember that outsourcing a function does not absolve an institution of its responsibility to ensure that controls are in place to protect its customers, data and, ultimately, its reputation!
2. Chp. 3, Slide 11
Proper governance of the program will ensure that: All parties know their roles, and responsibilities. Non-value-added activities and redundant ones are eliminated. Value-added activities are streamlined to reduce lag time and ensure consistency of execution. Part 1, Pg. 2, Paragraph 1
In addition, proper execution of a vendor management program can help ensure that non-value-added activities are eliminated and that value-added activities are streamlined to reduce delays in execution and facilitate consistency.
3. Chp. 3, Slide 15
Proper contract management will help avoid missing cancellation deadlines of auto-renew contracts and possibly being locked into a contract with a vendor whom the institution no longer cares to do business with. It will also help avoid costly legal fees to nullify the contract. Part 1, Pg. 2, Paragraph 2
Proper contract management will assist companies in avoiding missed cancellation deadlines for autorenew contracts and, therefore, enable companies to avoid being locked into a contract with a service provider with whom the institution no longer cares to do business. When vendor contracts renew unwantedly and need to be nullified, it often results in costly legal fees and wasted resources.
4. Chp. 3, Slide 16
A full understanding of a vendor’s products/services offering can help the institution improve its long-term vision and strategy. Part 1, Pg. 3, Paragraph 2
For example, a benefit to proper due diligence is gaining a complete understanding of a vendor’s products/services, which can help the institution improve its long-term vision and strategy.
5. Chp. 3, Slide 16
Vendors who become true business partner can often help the institution implement new value creation opportunities, become more innovative, cost effective and gain competitive advantage. Part 1, Pg. 3, Paragraph 2
In addition, strengthened vendor relationships lead to establishing true business partners, which can often help the institution create value through innovation and further cost-effectiveness.
6. Chp. 3, Slide 18
A reputation can take decades to build and only seconds to destroy Financial institutions used to build their reputations through community investment and by building partnerships with local businesses. But with the advent of outsourcing key businesses and technical functions, customers are often dealing directly with an institution’s vendors and the institution is in less control of the customer experience. Thus, Due Diligence, Ongoing Monitoring and Periodic Reviews are increasingly important. Part 1, Pg. 3, Paragraph 4
“It takes 20 years to build a reputation and 5 minutes to ruin it.” Customers often deal directly with an institution’s vendors and, as a result, the institution is in less control of the customer experience. Therefore, initial due diligence, ongoing monitoring and period reviews are increasingly important
7. Chp. 4A, Slide 11
Access to NPPI: Does the vendor process, store, dispose of, transmit, management, view/add/delete, transport or transmit sensitive data?
Dimensions of Risk (at least the following): Does the vendor represent reputational, compliance, strategic, transaction, operational, political or credit risk?
Physical Access: Does the vendor have access to secure areas of the bank, access to critical applications, infrastructure, environmental controls and/or utilities. Part 2, Pg. 2, Paragraph 2
 Sensitive data (including customers’ non-public personal information)
 Secure areas of the institution
 Critical applications
 Utility controls that protect the infrastructure (for example, heating or humidity on data service)
8. Chp. 4A, Slide 31
Categorize (stratify) your vendors and build a streamlined set of questions and critical documents required for the overall category of vendor. Placing similar vendors into the same bucket makes it easier to understand the types of vendors and how many of each type the institution does business with. This, in turn, helps the institution and the examiner better understand the institution’s risk profile. It also helps the institution focus its efforts on monitoring the vendors with the highest risk profiles. Part 2, Pg. 2, Paragraph 3
In order to properly assess the risk of an institution’s vendor baser, it is important to categorize or stratify the vendors by type of product or service that they provide and by risk tier (or classification of degree of risk). This process can help in communication with examiners and auditors regarding the institution’s risk profile and also provide important insight to those with whom you do business. This process helps the institution to focus its efforts on identifying and monitoring the vendors with the highest risk profiles.
9. Chp. 4A, Slide 10
There is a great deal of confusion over the difference between a critical vendor and a high risk vendor. The two terms are often interchanged when in fact they are quite different. Not all high risk vendors are critical vendors. However, critical vendors are almost always high risk. Think of the terminology as follows:
Critical vendor: a service provider that cannot easily be replaced and/or whose services, if interrupted, would cause significant financial and/or operational impact to the institution. Part 2, Pg. 3, Paragraph 1
Critical and other High Risk vendors should be identified first. A critical vendor is one that cannot be easily replaced if services are interrupted or terminated, which in turn may cause significant operational and/or financial impact. Most organizations have only a handful of critical vendors in comparison to the entire population, but it is paramount to understand who they are. All critical vendors should be considered high risk, although not all high risk vendors are necessarily critical to the institution (i.e. critical vendors are a subset of the high risk tier.
10. Chp. 4A, Slide 28-30
Once discussed, those concerns can be addressed through Questionnaires/score cards for Due Diligence. Audited financial statements, annual reports, SEC filings, and other available financial indicators. Significance of the proposed contract on the third party’s financial condition (are you their only client). Experience the ability in implementing and possibly monitoring the proposed service. Vendor business reputation. DR Test results, Security Assessment reports, SSAE 16’s or similar controls reports.
Due Diligence Examples:
 -Qualifications and experience of the company’s principals.
 Adequate insurance coverage Part 2, Pg. 3, Paragraph 2
An organization may conduct due diligence in the form of:
 Questionnaires/scorecards
 Review of financial condition
 Examining qualifications of company’s principals
 Making sure there is adequate insurance coverage
 Assessing vendor reputation
11. Chp. 7, Slide 29
Think twice about doing business if:
You cannot get the information requested despite numerous requests. It is likely doesn’t exist or there’s a reason that the Vendor won’t provide it. Information is outdated: Old financials, insurance or controls reports. Part 2, Pg. 4, Paragraph 1
However, in short, an institution should think twice about doing business with a vendor if:
 It cannot get the information requested, such as financials, insurance or controls reports, despite numerous requests. It likely does not exist or there is a reason the vendor will not provide it.
 The vendor delivers the requested information, but is outdated or of poor quality.
12. Chp. 7, Slide 29
 Information/Answers are vague: direct questions should receive direct answers.
 No single point of contact exists for information security. Every vendor should have someone in charge of it.
 Incident/History/ management shows issues without proof of testing and remediation. There could still be open items representing risk to your institution Part 2, Pg. 4, Paragraph 1
 Information/answers are vague or incomplete: direct questions should receive direct answers.
 There is incident history, such as regulatory or legal issues, without proof of remediation. They may still be open items representing risk to your institution
13. Chp.4B, Slide 16
Every contract should be reviewed by a qualified staff member or legal counsel trained in contract review for the purpose of mitigating the institution’s risk. Examiners and auditors will frequently ask who reviewed the contract.
Vendor Management Program: Contract Review FFIEC Guidance Recommends.
1. Ensure the contract clearly defines the rights and responsibilities of both parties.
2. Ensure the contract contains adequate and measurable service level agreements.
3. Ensure contracts with affiliates clearly reflect an arms-length relationship costs and services are at least as favorable to the
institution as those available from a non-affiliated provider.
4. Choose the most appropriate pricing method for the financial institution’s needs.
5. Ensure the contract does not contain provisions or inducements that may have a significant/ adverse affect on the institution.
6. Engage legal counsel to review the contract. Part 2, Pg. 4, Paragraph 2
Because of the contract’s importance, a vendor management program should:
1. Ensure the contract is clearly written in accordance with plain language standards. It should describe the outsourcing relationship and sufficiently define the rights and responsibilities of each party.
2. Choose the most appropriate pricing method to meet the needs of the organization.
3. Verify the contract does not contain provisions that may have a significant and adverse effect on the institution.
4. Engage in legal counsel early in the process to help prepare and review the proposed contract (every contract should be reviewed by a qualified staff member and legal counsel).
14. Chp. 5, Slide 3
Analyze Current State Part 3, Pg. 2, Heading (Step 1)
Step 1: Analyze the Current State
15. Chp. 5, Slide 3
The first step in building a compliant vendor management program is to analyze the current state even if it only consists of a spreadsheet and loosely followed policy and procedures. Part 3, Pg. 2, Paragraph 1
The first step in implementing a new vendor management program or enhancing an existing one is to analyze the current process and practices associated with selecting, evaluating and monitoring third party providers.
16. Chp. 5, Slide 4
Executive Sponsorship Part 3, Pg. 2, Heading (Step 2)
17. Chp. 5, Slide 5
Vendor Oversight Committee
 Reinforces governance of policy
 Brings multiple skillsets to the task at hand
 Mitigates multiple dimensions of risk Part 3, Pg. 3, Heading (Step 3), Paragraph’s 2-3
Step 3: Establish Governance – a Vendor Committee
The primary purpose of a vendor Oversight Committee is to reinforce governance of policy and process. The overall charge is to ensure that the organization have a detailed and documented process for selecting, assessing and overseeing vendor relationships as well as ensuring that there is appropriate mitigation of risks. In addition, this committee should be a forum for escalating vendor issues when needed, including contract, performance, and financial issues.
An oversight committee can take the shape of various forms, whether comprised of members of the executive suite or a combination of
those individuals designated to oversee risk. However, it is vitally important that this committee have the appropriate level of executive
sponsorship to establish the program’s stature within the organization. In fact, this committee should present to and be approved by the institution’s Board of Directors, particularly given that the Board is ultimately responsible for oversight of third-party risk. The composition of the committee should bring multiple skillsets of key individuals that will provide expertise in the areas of risk assessment, due diligence, and contract management, and should also consider how third-party relationships affect strategic initiatives of the organization.
18. Chp. 5, Slide 9
Sponsor/Stakeholder Buy-in
1. It is essential that a senior level executive attends so that the group understands that it is a top-down initiative. In larger organizations, meetings with multiple groups may need to take place. Part 3, Pg. 3, Heading (Step 4), Paragraph 4
Step 4: Obtain Stakeholder Buy-in
Any initial meetings that occur with stakeholders for the purpose of introducing the new process should also be attended by the Executive Sponsor, with clear communication that the implementation of this program is an executive “top-down initiative”.
19. Chp. 5, Slide 10
 Why comply: Regulatory penalties for non-compliance
 Benefits of a complaint vendor management program
 Explain that streamlining the process reduces work for the sponsor.
 Position participation as part of a team effort to improve the operational effectiveness of the institution
 Possible improvements in price and contractual terms Part 3, Page 4, Paragraph 1
 Regulatory reasons for compliance, as applicable (including penalties for noncompliance)
 Business and economic benefits of a formal program including:
 Participation as part of a team effort will improve the operational effectiveness of the organization
 Anticipated improvement in position of negotiation through proper contract management, leading to improvements in price and contractual terms