I have been out of this loop for over 10 years and am in need of some guidance.

We have been advised by the FDIC that we need to do on-site inspections of our critical vendors. For vendor managment purposes we have identified 20 or so critical vendors and management is concerned about the expenses involved with doing these on-site reviews.

I would like to hear from those of you that are doing on-site reviews. Which vendors are you visiting and what are you doing during these visits? Do you take a questionnaire or checklist with you? Do you find that the vendors are willing to let you on-site?

Any advice is greatly appreciated!

We do not conduct on site visits of critical vendors and it's never been suggested we do. Our core processor though, our CEO is Chairman of the Board and is there on-site for meetings all the time and many of attend training sessions there.

I have never heard of such a ridiculous blanket recommendation. I would be having your CEO call the regional supervisor directly and ask them to please provide in writing a little clarification regarding the basis of this recommendation. I would start with some basic questions, such as: Is there a problem with your current due diligence process? How do they define critical vendor? For vendors that provide services based on redundant or distributed systems, which cite would they like you to visit? Just exactly, when conducting a cite visit, what would they recommend that you review and document so that you can provide the information in a report format they are seeking on their next visit. Etc.

I agree! TTC, the critical vendors, for the most part will be fairly large with detailed back-up and recovery procedures of their own. By necessity, many will have multiple sites, scattered around the US, and potentially the world. How is a visit to a site (headquarters, underground recovery, secret back-up hot site) supposed to help the bank.

Their management will most likely not even allow someone into their critical areas, and how would a site visit enhance the bank's knowledge, other than to ensure that a building (named or unnamed) is secure. I believe your regulator is well intentioned but totally out of the loop, or misunderstood.

If FDIC insists, volunteer to visit the vendor's Hawaii location during the winter months.

I volunteer to visit Hawaii during the winter months

we have done on-site visits to vendors when performing due diligence when assessing new business with them, but as far as ongoing on-site for reviewing critical on a recurring basis, not going to happen. We'll perform our annual review, annual DR certification, and would only go on-site if we thought there were some significant issues. Have never had a regulator question our process or tell us we needed to do it.