Title of Report [omit Audit ofŽ]

February 2007 Report No. 07-005 Information Technology Examination Coverage of Financial Institutions’ Oversight of Technology Service Providers AUDIT REPORT Report No. 07-005 February 2007 Information Technology Examination Coverage of Financial Institutions’ Oversight of Technology Service Providers Results of Audit Background and The FDIC has provided guidance to examiners to assess financial institutions’ Purpose of Audit oversight of TSPs. In particular, the IT-RMP guidance requires examiners to consider the interagency guidelines in scoping examinations but does not detail In the first 10 months of examination procedures to assess compliance with the key controls over TSPs. 2006, over half of the 213 Two of the four IT-RMP tools could be enhanced to provide information and information security breaches examination procedures for assessing the risks associated with protecting the reported by financial institutions security and confidentiality of sensitive customer information when FDIC-to the FDIC involved technology supervised institutions use TSPs. Specifically, the IT-RMP Officer’s service providers (TSP). In Questionnaire, completed by institution management, could request information accordance with federal laws and about the financial institution’s key controls over TSPs. Additionally, guidance in regulations, financial institutions the Snapshot Work Program could specifically address key controls related to ...