Vendor contract controls for OCC and FFIEC examinations

Interagency guidance on third-party relationships is explicit that the depth of risk management should be proportionate to the risk of the relationship. That principle sounds accommodating and is the source of most examination findings, because proportionality has to be demonstrated. A bank that applies the same contract template to a landscaping supplier and a core processor has not applied a risk-based approach, and a bank that cannot show why a term was omitted has not documented one.

Contract terms sit at the center of this because they are where the risk decision becomes durable. Due diligence produces an assessment, but the contract is what obliges the provider to behave in a particular way, and it is what the institution relies on when the relationship deteriorates. Examiners therefore read contract terms as evidence of the risk decision rather than as legal boilerplate.

This datasheet sets out the contract controls that matter across the relationship lifecycle, the terms that draw the most examination attention, and the evidence each control should produce. It is written for third-party risk, procurement and contract operations teams preparing for examination or rebuilding a program.

Controls by relationship stage

Third-party risk is a lifecycle discipline, and the contract is only one stage of it. Examiners look for continuity across the stages rather than strength in any single one.

• Planning, documented rationale for using a third party, the criticality determination, and the risk tier that will govern diligence depth and contract requirements
• Due diligence, assessment of financial condition, operational capability, information security, subcontracting practice and resilience, with depth scaled to the tier
• Contract negotiation, required terms present for the tier, deviations documented with rationale and approval, and the executed agreement linked to the diligence that supported it
• Ongoing monitoring, performance against service levels, changes in the provider’s risk profile, and evidence that contract obligations on both sides are being met
• Termination, exit planning, data return and destruction, transition assistance, and confirmation that surviving obligations are tracked after the relationship ends

The most common structural weakness is a break between diligence and contracting. Diligence identifies a concern, the concern is not converted into a contract term, and the contract is signed with a standard clause set. At examination the institution can produce both artifacts and cannot show the link between them. Recording the diligence finding, the corresponding contract requirement and the approval of any deviation on a single record removes that gap. It also shortens preparation, because the examiner question about why a term was accepted has an answer stored next to the term rather than in the memory of whoever negotiated it.

Contract terms that draw examination attention

Certain provisions receive consistent attention because they determine what the institution can do when a relationship fails. Presence alone is not sufficient; the terms are tested for whether they are usable.

• Performance standards. Service levels need defined measurement and remedies. A commitment to industry standard performance is not a testable obligation and does not support monitoring
• Subcontracting. The institution should know who is in the chain, retain approval or notification rights for material subcontracting, and hold the primary provider responsible for subcontractor performance
• Information security and incident notification. Notification timelines should be specific and short enough to support the institution’s own regulatory reporting obligations, which are frequently tighter than a generic clause allows
• Audit and access rights. Rights should extend to the institution and to its regulators, with practical mechanics on frequency, scope and cost, since unusable rights provide no assurance
• Termination and data return. Termination rights should cover performance failure and regulatory circumstances, with data returned in a usable format and destruction certified within a defined period

A five-step readiness sequence

Step 1, Confirm the inventory is complete

Examination begins with the population. Reconcile the vendor master, accounts payable and the contract repository, because unrecorded relationships are the finding that undermines every downstream control.

Step 2, Apply and record risk tiers

Tier every relationship using documented criteria, and store the tier on the contract record. The tier is what makes proportionality demonstrable rather than assertable.

Step 3, Test the portfolio against tier requirements

Run clause extraction against the required term set for each tier and produce a gap list. This converts a policy statement into a measurable position and identifies where remediation is genuinely needed rather than assumed. Portfolios usually contain fewer real gaps than expected in the critical tier and more than expected in the middle tier, where standard paper was accepted without a tier check.

Step 4, Build the deviation register

For every gap, record the reason, the compensating control, the approver and the review date. Gaps that are known, approved and monitored are managed risk; gaps that are unknown are control failures.

Step 5, Monitor obligations after signature

Assign owners to notification windows, reporting obligations, audit rights and service level reviews, with escalation on breach. Monitoring is examined as an ongoing activity, not as an annual attestation.

What proportionality looks like in practice

Risk-based does not mean lighter for everyone. It means the institution can explain why a given relationship received the treatment it did. In practice that produces a tiered model with a small number of critical relationships carrying full diligence, full contract terms, continuous monitoring and board-visible reporting, a larger middle tier with defined diligence and a standard required clause set, and a long tail where the controls are proportionate to a low impact of failure. The tier assignment has to be made against documented criteria, applied consistently and revisited when the relationship changes, because a supplier that starts as a low-risk tool and ends up processing customer data has moved tiers whether or not anyone updated the record. Connecting the tier to the contract record, and to the obligations monitored after signature, is what keeps the model honest between examinations.

Control, evidence and owner at a glance

The table below summarizes the core contract controls, the evidence each produces and the function that typically owns it.

Examination readiness for third-party contracts comes down to three questions an institution should be able to answer for any relationship on demand. What tier is it, and on what basis. Which required terms are present, which are missing, and who accepted the gap. What obligations are being monitored, by whom, and what happened the last time one was missed. Programs that can answer those from records rather than from recollection tend to examine well, regardless of how the underlying documents are drafted. The reverse is also true. A well-drafted portfolio with no tiering record, no deviation register and no monitoring history will still be tested as an undocumented program, because the examiner is assessing the decision process rather than the language.

For related guidance, see Vendor contract controls for OCC and FFIEC exam readiness, Complementary user entity controls in vendor contracts and The bank’s guide to DORA ICT third-party contract terms.

Aavenir Financial Services PracticeThird-party risk controls, examination readiness and contract governance