Does anyone have any suggestions for a starting point in regards to auditing vendors? I am looking for information regarding outsourcing requirements and 3rd party servicers?? Any websites or regulations would be most helpful. Thank you!

You might refer to the Interagency Guidelines Establishing Standards for Safeguarding Customer Information and/or the FFIEC website.

I did read through GLBA in regards to safe guarding customer information. Obviously a contract is going to be in place. I was wondering if I would just be auditing the contract, ensuring that is has safe guards in place for proecting customer information. Just wondering if this is all I would be able to audit? Thanks dl for your suggestion.

Refer to OCC Bulletin 2001-47.

Be sure to include the due diligence requirements (same FFIEC procedures) like reviewing the 3rd party service provider's SAS70 report and any other audits (like their own internal ones). Of course this one would mainly be for your core providers or larger companies that are actually required to have the external audits performed.

Besides the before mentioned items, we also request the audited financial statements of our critical vendors or if publicly traded pull a D&B. Our credit analyst reviews the financial information and prepares a write-up of the trends for the company. If you see a vendor with negative financial trends, it may be time to begin looking for a new vendor.

Thank you Swanky, do you mind sharing how you set up your audit template? There are so many things I feel I need to include in my template that I feel a little overwhelmed at where to start. Any guideance there? Thanks again for everyone's assistance. This has been awesome.

Oh also forgot to mention - do state to state requirements apply to this audit? I haven't seen anything so far that is specific to state but than again I've only begun my research.

Swanky, do you mind sharing how you set up your audit template on Vendor Auditing to me also? Thanks

I sent a PM to ene0712, perhaps he will forward to you. IMHO, you cannot use a canned template when preparing to audit a vendor. What you will be reviewing will be largely determined by the regs governing the outsourced function, your contract with the vendor, and/or any service level agreements with the vendor or downstream processes. This should be your starting point and should be done before you set foot in the vendors door. You should also examine the vendors financial statement, and pull a D&B at minimum. You don't want to risk a critical function to a vendor that may not exist a year from now. Once that is done, you should audit the vendor as if the function were still in-house.

Anon I'll be more than happy to forward the pm to you if you'll pm me with your addy or name.

Thanks!