Office of Thrift Supervision

Guidance on Information Technology Management and Outsourcing Technology Services Released by Federal Financial Institution Regulators

The Federal Financial Institutions Examination Council (FFIEC) today issued revised guidance for examiners, financial institutions and technology service providers on two topics: managing financial institutions' information technology (IT) activities and outsourcing technology services.

The Management Booklet provides guidance on the risks and risk-management practices applicable to financial institutions' information technology activities. Sound IT management is critical to the performance and success of a financial institution. An institution capable of aligning its IT activities to support its business strategies adds value to its organization and positions itself for sustained success. The board of directors and executive management should understand and take responsibility for IT management as a critical component of their overall strategic planning and corporate governance efforts.

The Outsourcing Technology Services Booklet provides guidance on the risks and risk-management practices applicable to financial institutions' outsourcing IT activities, including service provider selection, contract issues, and ongoing monitoring of the relationship. The booklet also includes guidance on the risks and risk-management issues unique to foreign service providers. Outsourcing of an activity does not relieve management and the board of directors of their responsibility to ensure the institution's data are processed in a secure environment and the integrity of the data is maintained. Thus, ongoing monitoring of the relationship is crucial to ensure key terms of service level agreements are followed, confidentiality of information is safeguarded and the service provider maintains operational stability.

These booklets represent the latest in a series of updates to the 1996 FFIEC Information Systems Examination Handbook (Handbook). The FFIEC has updated the Handbook to address significant changes in technology since 1996 and to incorporate a risk-based examination approach. The updates are being issued in separate booklets that eventually will replace all chapters of the Handbook and comprise the new FFIEC Information Technology Examination Handbook. Future booklets will cover Operations and Wholesale Payment Systems. With the release of the Outsourcing Technology Services Booklet, the FFIEC guidance Risk Management of Outsourced Technology Services, dated November 28, 2000, is rescinded.

The booklets are being distributed electronically and are available at www.ffiec.gov/guides.htm.

Media Contacts:

FRB:	Susan Stawick	202  452-2955
FDIC:	David Barr	202  898-6992
NCUA:	Cheryl Umbel	703  518-6337
OCC:	Dean DeBuck	202  874-4876
OTS:	Erin Hickman	202  906-6677

The Office of Thrift Supervision, an office of the Department of the Treasury, regulates and supervises the nation's thrift industry. OTS's mission is to ensure the safety and soundness of, and compliance with consumer protection laws by, thrift institutions, and to support their role as home mortgage lenders and providers of other community credit and financial services. For copies of news releases and other documents, visit the OTS web page at www.ots.treas.gov.

Created: Friday, 7/23/2004