Processes are outsourced or performed at the customer location. Evaluate the use of in-house and outsourced data processing systems to support retail payment products and processes. Consider: How stable are existing systems. How current are existing systems. Whether there is adequate capacity for current and planned transaction volumes. Whether the institution uses leading edge technologies or only mature technologies. To what extent are systems outsourced. Whether outsourcing arrangements are governed by contracts and service level agreements. Whether vendors are considered to be industry-recognized leaders. Objective 2: Establish the scope and objectives of the examination of the retail payment systems function. Review previous reports of examination for comments relating to retail payment systems. Review: Regulatory reports of examination, including consumer and compliance information. Prior examination work papers, including any documentation obtained through on-going supervision. Internal control self-assessments completed by business lines. Internal and external audit reports, including annual attestation letters. Regulatory, audit, and information security reports from service providers. Trade group, bankcard company, interchange, and clearing house documentation relating to services provided by the financial institution, particularly the NACHA required annual security audit and bankcard company self assessments. Supervisory strategy documents, including risk assessments. Review past examination reports for comments relating to the institution’s internal control environment and technical infrastructure. Review: The institution’s processing architecture, including processing outsourcing arrangements. Internal controls, including physical and logical access controls in the data entry area, data center, and item processing operations. Electronic Funds Transfer (EFT)/Point of Sale (POS) network controls.
Contractual protections against liability. Assess the extent to which the institution Reviews the financial stability of the technology service provider; Analyzes the service provider’s audited financial statements and annual reports; Assesses the service provider’s length of operation and market share; Considers the size of the institution’s contract in relation to the size of the service provider; Reviews the service provider’s level of technological expenditures to ensure on-going support; and Assesses the impact of economic, political, or environmental risk on the service provider’s financial stability. Evaluate whether the institution’s due diligence considers the following: References from current users or user groups about a particular technology service provider’s reputation and performance; The service provider’s experience and ability in the industry; The service provider’s experience and ability in dealing with situations similar to the institution’s environment and operations; The cost for additional system and data conversions or interfaces presented by the various technology service providers; Shortcomings in the service provider’s expertise that the institution would need to supplement in order to fully mitigate risks; The service provider’s proposed use of third parties, subcontractors, or partners to support the outsourced activities; The service provider’s ability to respond to service disruptions; Key service provider personnel that would be assigned to support the financial institution; The service provider’s ability to comply with appropriate federal and state laws. In particular, ensure management has assessed the service providers’ ability to comply with federal laws (including GLBA and BSA); and Country, state, or local risk. Verify that the contract appropriately addresses: Scope of services; Performance standards; Pricing;