We are continually searching for innovative products and services to enhance our members' ability to meet their rising stakeholder demands. (TGl%XUG&:SR62$Yt7"RB0AQr!cT\HR1%HQ,mAFt8#5KI I"EX&IzKYBVt&:H#]"I}R&0!jRRxC"}W$$5LuDaCHa#iHudi=,)u }*yS0R)ku4LtH:(QP$g#I,5!AFZ$>}X>S;Myng|_5oVyys. endstream endobj 898 0 obj <>/Filter/FlateDecode/Index[136 722]/Length 46/Size 858/Type/XRef/W[1 1 1]>>stream /AvgWidth 536 hbbd``b`kAD(`$ At a minimum, OSFI expects the FRFI to include in written agreements the provisions that are set out in pl \nux#HTW.w_>,cC]!CI KkGCi %ns70T(h&`0%i,`Q)6(%Nf`Isg0OJ>lHp4@7Ukz 5C;7}?p&u 7R:cA4iGSmfEl! gO/M]!yi;3]LDBBC)!p7,:f?Hw5NznlFIgu);)Lr}@dnv8/>bT,+\IqbK?xaK'rBj6o[(NicA[fG9#Hi LM#i 09Y%Z~hlCKK,LV^\[yoK "3Ca o%.ojOa` y_n*;21'.$T%tINe9RuBvF8ducOgop&r# _Z[ 0000006666 00000 n Technology and Cyber Risk Management and. The agreement should also specify whether the third party must continue providing the service during a dispute and the resolution period, as well as the jurisdiction, governing law(s), and rules under which the dispute will be settled. % /LastChar 122 These specific requirements should optimize interoperability while operating within the FRFIs stated risk appetite. periodically on an ongoing basis proportionate to the level of risk and criticality or whenever there are material changes to the third-party arrangement, such as the nature of the arrangement or its criticality. Please see Sections 2.3.2.1 and 2.3.2.2 of this Guideline. Potential for political or legal risks related to the jurisdiction of the third party, or the jurisdictions of any material subcontractors. <> Principle 2: The FRFI should establish a third-party risk management framework (TPRMF) that sets out clear accountabilities, responsibilities, policies, and processes for identifying, managing, mitigating, monitoring, and reporting on risks relating to the use of third parties. Principle 8: The FRFIs third-party arrangements should allow the FRFI timely access to accurate and comprehensive information to assist it in overseeing third-party performance and risks. endstream Trust and Loan Companies Act. Principle 6: The FRFI should enter into written arrangements that set out the rights and responsibilities of each party. +tU"+E2!iXNU}/!:K}#XSP18ixWq5qAJgna\8ne~k`3u'w** %pdj]WD!S^U6$Iksr%RH*f&ovT Q(^SJ+iuZy/~Fw2k7jL:J stream endobj Roles and Responsibilities: The agreement should clearly establish the roles and responsibilities of the FRFI and the third party and any material subcontractors of the third party, including for managing technology and cyber risks and controls. 1.2. <> Such provisions could include, among other things, requirements to promptly notify the FRFI of technology and cybersecurity incidents (at the third party or the subcontractor) including providing information on each incident in line with the Advisory. 5 0 obj Trust and Loan Companies Act (collectively, the FRFI Statutes), contain requirements with respect to certain records that FRFIs must prepare and maintain (the Records).Footnote 8 OSFI expects the Records to be updated and accurate as at the end of each business dayFootnote 9, and that the Records will be sufficiently detailed to enable: OSFI to conduct an examination and inquiry into the business and affairs of the FRFI; OSFI to manage the FRFIs assets, prior to the appointment of a liquidator, should the Superintendent take control of the FRFIs assets; and. The FRFIs Senior Management should be satisfied that business activities, functions, and services performed by third parties are done in a safe and sound manner, and in compliance with applicable legislative and regulatory requirements and the FRFIs own internal policies, standards, and processes. 190 0 obj At minimum, due diligence should consist of the following non-exhaustive factors: Experience, technical competence, and capacity of the third party to implement and support the activities it is being engaged to provide, including, where applicable, the experience, technical competence, and capacity of material subcontractors; Financial strength of the third party to deliver successfully on the third-party arrangement; Compliance with applicable laws, rules, regulations and regulatory guidance within Canada and other relevant jurisdictions; Potential reputation risk associated with the third-party relationship or its services, including existence of any recent or pending litigation, investigation or complaints against the third party; Strength of the third partys risk management programs, processes, and internal controls as well as the reporting environment (the FRFI should determine if there is alignment with the FRFIs risk management processes and controls); manage technology and cyber risks in accordance with the expectations outlined in OSFIs Guideline B-13: Third-party provider, subcontractor and geographic concentration have the potential to increase overall risk to FRFIs and the financial services industry by: Criticality is the degree of impact of the third-party arrangement on the FRFIs risk profile, operations, strategy and/or financial condition. endobj Among other ways, the FRFI might achieve this by: contractual provisions prohibiting the use of subcontractors for certain functions; requiring that the FRFI be informed, in writing and on a timely basis, when a subcontractor is retained, or substituted, to carry out some of the functions contracted for the third party to perform; reserving a right of the FRFI to refuse a subcontractor; and. In addition to planning appropriate exit strategies (see Section 2.3.5), the FRFI should also consider portability when entering an arrangement with a cloud service provider and as part of the design and implementation process in cloud adoption. 4262 0 obj <>stream The FRFI should develop cloud-specific requirements to ensure that cloud adoption occurs in a planned and strategic manner. Draft Guideline B-15 %%EOF The agreement should not contain any terms that inhibit OSFI, or any other resolution authority or financial compensation scheme, from carrying out their mandate in times of stress or resolution. stream To access it and other valuable resources, become a member today or log in! reducing the market power of FRFIs vis--vis the third party to negotiate favorable arrangements. If the Records are in electronic form, complete copies must be kept on a computer server(s) physically located at the places stipulated in the FRFI Statutes.Footnote 10, Certain FRFIs are exempted from the requirement to keep copies of the Records at the above noted places in Canada. Specifically, the FRFI and OSFI should be able to evaluate the risks arising from the arrangement or appoint independent auditors to evaluate the risk management practices related to service provided and the risks arising from the relationship on the FRFIs or on OSFIs behalf. /FontWeight 700 Third-Party Risk Management and 0000003504 00000 n )-08='!cQB?$7yIvrwL^]V|$RxB99|=WVWi?J'>$I~T#KR7tli[ktF6\)fv7If@Z>l Copyright 2022 The Institute of Internal Auditors. The absence of a written arrangementFootnote 14 does not obviate the existence of a third-party relationship. 0000033338 00000 n Corporate Governance Guideline for OSFIs expectations of FRFI Boards of Directors in regard to business strategy, risk appetite and operational, business, risk and crisis management policies. startxref Remediation actions should be monitored by the FRFI. ability of subcontractors to meet legal and regulatory requirements. 0000002582 00000 n These outcomes contribute to the FRFIs operational and financial resilience and help safeguard its reputation. /Group << /CS /DeviceRGB /S /Transparency /Type /Group >> Outcome: Third-party performance is continually monitored and assessed, and risks and incidents are proactively addressed. <>/Font<>/XObject<>/Pattern<>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/MediaBox[ 0 0 540 732] /Contents 4 0 R/Group<>/Tabs/S/StructParents 0>> This is formembers only. /CropBox [ 0 0 594.96 842.04 ] 0000000016 00000 n OSFI recognizes that there are certain third-party arrangements for which a customized contract may not be feasible, or for which a formal contract or agreement may not exist. 0000002339 00000 n 0h (B"JZZ{bdF$9TeGN{MldbE0qER]VR4cEFj7e7y"j(15i/$m;NkiqYIQovwgZQ"t`3BMJT2O|]Q]~0}~Kn2J FA( 2&`O-Y{l9zjcJapK2qn5,VQ/Q6)7hz~ Principle 11: Both the FRFI and its third-party should have documented processes in place to effectively identify, investigate, escalate, track, and remediate incidents to ensure ongoing operational and financial resilience and maintain risk levels within the FRFIs risk appetite. Annex 2 of this Guideline. The FRFIs risk management program is dynamic and actively captures and appropriately manages a range of third-party relationships and interactions. September 30, 2022. Bank Act, /FirstChar 32 Third party performance is continually monitored and assessed, and risks and incidents are proactively addressed. xY[o8~G?1Y kKt/CB7M5=xg wn?*'~W7k;^'t6_|^9?qXlnY[v{ )2[Z3I)"4;0d #q9 2n%0oV "MeYlJP$4[ae/=h=x 8P?%#0$mE|FAMa``vtulRlUs>"SHAFF`vl]2Pn^i8rXvreXv%Z%C[ G -vAp9R'L1mzuPC:2y$tebkS-;iT!vWR$Y=E&$=V0Dla/hqkk{3C#[5%/y @}(]n)"3uKy! uOl%9Xsb:|GDDYv~LS1 Vb%_p2i ?o7 Principle 4: The FRFI should undertake due diligence prior to entering contracts or other forms of arrangement with a third party, and on an ongoing basis proportionate to the level of risk and criticality of the arrangement. << <> The FRFI should also have the right to conduct or commission an independent audit of a third party. As applicable, joint design and testing of business continuity plans and disaster recovery plans should be considered between the third party and the FRFI, commensurate with the criticality of the service. 262(1) of the Jn}UjH i. They should also augment existing FRFI controls and standards, notably in the areas of data protection, key management, and container management. FlEh]3c#%MO ? 0 The FRFIs criteria to assess the risks of third-party arrangements should be comprehensive and focus on higher-risk arrangements, while maintaining oversight of other arrangements in accordance with the FRFIs risk-based approach. %PDF-1.7 % RNYu1LP=9"PXPP'Ybw0, ;0Ml 1@RFQZN;T2=T]}$_v^Aff. The FRFI should establish processes to confirm regularly that the residual risk of their third-party arrangements, individually and in aggregate, remains within the FRFIs risk appetite. Foreign insurance company branches refers to foreign entities that are authorized to insure in Canada risks on a branch basis under Part XIII of the Dispute resolution: The agreement should incorporate a protocol for resolving disputes. Specifically, the FRFI should conduct risk assessments to decide on third-party selection; (re)assess the risk and criticality of the arrangement; and plan for adequate risk mitigation and oversight. In addition, the FRFI should evaluate and consider the impact of use of subcontractors on the concentration risk of third-party arrangements (refer to 2.2.3 above). endobj /Descent -250 0000002508 00000 n This practice guide is a useful tool to become better informed on risks related to third-party provider management. 1 0 obj }aCg0_1kribZ~.7i_,Vl(nttCn7HZZZFli Wtt 0Qvj -@=@ZzXX00Y0000 #O!aZ%LXpa`|Xp'4{^yC9=qAL The processes established should clearly define accountabilities at all levels of the FRFI and triggers for escalation within the FRFI. Due diligence should consider all relevant qualitative (i.e., operational) and quantitative (i.e., financial) factors related to the third-party arrangement. making substitutability of the third party more difficult; increasing the likelihood that the insolvency of or an operational disruption at a third party or its subcontractor has ramifications on the FRFI or throughout the financial services industry; exposing the FRFI or the financial services industry to increased impact of natural disasters or other external events; and. The Office of the Superintendent of Financial Institutions (OSFI) expects that FRFIs practice effective risk management and retain ultimate accountability for all their business activities, functions, and services, whether they are performed in-house or through a third-party arrangement. Determining whether the organization has a third-party risk management structure that results in a patchwork approach, and, if so, how to bring it together into an enterprisewide framework. The TPRMF should reflect the FRFIs risk appetite and be consistent with its operational or enterprise risk management frameworks. Records that change less frequently than daily remain accurate until they change. Risk acceptance refers to a decision to accept an identified risk and not take any, or further, mitigating actions. An outsourced activity, function or service is one that is, or could be, undertaken by the FRFI itself and is a type of third-party arrangement. OSFI expects the FRFI to regularly review and update its TPRMF, and to make continuous improvements based on implementation, effectiveness and other lessons learned (e.g., past incidents). Recommended jsJc=8#Ap5EVyt =*J\UQP`kG5-;`Slwr=eITvHxEgza4w~>9ip- pbe[[>S^F}3LUQ!La^IVxn0OGdthZn; pWb]@fb"?L^`V+X^]_oUcN~+wBMuIn&Lo ugC=uWZ3]sPO=~i7ZU) Cuk>?&^`qmOwMo_ mpxx'e8}6:{k]_4OmvZ=Y'B).k9i15rhL Q0+oDz8!%+J6_rJ>(aN6)S!sPdu)-E-#ui.VGSV>X;;Y)ls-bN|[>,eh+1:OAz+D>m{{Kg3-k /Flags 32 Bank Act. %PDF-1.7 Prudent risk management: The agreement should include any additional provisions necessary for the FRFI to prudently manage its risks in compliance with this Guideline. all expectations set out in Section 2 be considered minimum expectations. The FRFI should also ensure that they have ongoing line of sight into the third partys use of subcontractors. Third-Party Risk Management Framework (TPRMF), 3.1. Refer to Guideline B-13 - Arrangements with the external auditor can give rise to conflicts of interest. Developing a structure for scoping, planning, and executing third-party risk audits. /XHeight 250 b XmO%# Nha0 244(3.1) of the Principle 1: The FRFI is ultimately accountable for all business activities, functions, and services outsourced to third parties and for managing the risks related to third-party arrangements. Third-party agreements should require the third party, at minimum, to: outline the third partys measures for ensuring continuity of services in the event of disruption; test regularly the third partys business continuity and disaster recovery programs as they pertain to services provided to the FRFI; Among other things, the FRFIs business continuity and disaster recovery plans should: address severe but plausible situations (either temporary or permanent) where the third party could fail to continue providing service; set out backup systems and redundancies commensurate with the criticality of the service provided; and, ensure the FRFI has in its possession, or can readily access, all necessary records to allow the FRFI to sustain business operations, meet statutory obligations, and provide all information as may be required by OSFI, in the event of disruption to third-party services.Footnote 12. !NeKFf,$#%e-6=}yys/ 0u C: Kqr@/ Xx%]HHsDFt}%;/>J}K=TBo^u@j.U)9&1o]7[,aH4\XTq3Ei65q$'6dKH%^%A3~7T"3b4TE)CQDe&8FMtIF]~XmK2+(~x7 0000012341 00000 n Outlining key roles, responsibilities, and risks in managing third-party providers. 0000003467 00000 n 262(3.1) of the ;QeUVj(oF/pf^ vTkb`Sr5f\^W8 dKhpom8J_3K#[+{q.hp2$)]H0Yt>HYbiaMA"T+=[8/%v:g\w@`30aPe"q`/0GT2eS%#EC,Ar0u9wZw .G FP/l_T^UjN$ Sc"90XIh$4|>@6jG0)tLi|wv/ ],ANMuQu4 Risks across the full vendor life cycle are considered, including the appropriate sourcing, ongoing management, and termination of vendors. Risks posed by third parties are identified and assessed. provide the FRFI with sufficient and timely information to comply with its reporting requirements under OSFIs 0000002739 00000 n This Guideline sets out OSFIs expectations for managing risks associated with third-party arrangements. 0000005943 00000 n Principle 9: The FRFIs agreement with the third party should encompass the ability to deliver operations through a disruption, including the maintenance, testing, and activation of business continuity and disaster recovery plans. The agreement should also require the third party to notify the FRFI in the event of significant changes in insurance coverage. /Filter /FlateDecode Federally regulated financial institutions (FRFIs) engage in business and strategic arrangements with external partiesentities or individualsto perform business activities, functions, and services in support of their own operations or their business strategy. 0000008649 00000 n The FRFI Statutes require FRFIs to keep copies of the Records at its head office, or at such other place in Canada as the directors of the FRFI think fit. OSFI expects the FRFI to manage third-party risks in a manner that is proportionate to the level of risk and complexity of the FRFIs third-party ecosystem. The TPRMF should be developed to span the lifecycle of a third-party arrangement, from sourcing and due diligence of a third-party provider to potential exit from the third-party arrangement. endobj Principle 3: Before entering a third-party arrangementand, periodically thereafter, proportionate to the level of risk and criticality of the arrangementthe FRFI should identify and assess the risks of the arrangement. Such arrangements include, among other things: outsourced activities, functions, and services;Footnote 3. brokers (e.g., mortgage, insurance, deposit brokers); utilities (e.g., power sources, telecommunications); financial market infrastructuresFootnote 4 (e.g., payments systems, clearing and settlement systems, other FRFIs in cases where the FRFI does not have direct access to financial market infrastructures); services provided by parent holding companies, affiliates, and subsidiaries, or through joint ventures and partnerships; and, other relationships involving the provision of services or the storage, use or exchange of data (such as cloud service providers, managed service providers, technology companies that deliver financial services).Footnote 5. Third-party risk is the risk to the FRFIs operational and financial resilience or reputation due to a third party failing to provide goods and services, protect data or systems, or otherwise carry out activities in accordance with the arrangement. 3 0 obj <> OSFI expects the FRFI to assess its third-party arrangements regularly, with higher-risk and more critical arrangements subjected to more frequent and rigorous assessment. , <>/Metadata 285 0 R/ViewerPreferences 286 0 R>> When considering arrangements with third parties based outside of Canada (or Canadian third parties with material subcontractors located outside of Canada), the FRFI should pay particular attention to the legal requirements of relevant jurisdictions, as well as the potential political, legal, security, economic, environmental, social, and other risks that may impede the ability of the third party to provide services.

Sitemap 17