Written by Josh Layne, Vice President of Compliance, and Rashida Cohen, VCS
We know you have engaged Maple Street to assist with managing your vendors, but did you know we’re also here to help you pass your exam?
With nearly 20 years’ experience working with vendors and dealing with examiners, we’d like to think we know a thing or two, including what examiners may expect.
Examiners want to know the answers to questions like:
- How do you maintain a complete, accurate vendor inventory?
- How are you monitoring your vendors for risk and performance?
- How do you vet and select new vendors?
- How well do you contract and are you negotiating favorable terms?
Maple Street suggests a few key areas of focus in CADi when preparing for your exam.
Policy and Procedures Widget on Home Page
Firstly, do you have an updated policy and procedure in place? If not, we offer templates for you to review, edit and personalize to your institution. We take it a step further by separating the policy from the procedures so you can have the freedom to make changes to procedures as you see fit without needing to reapprove policy. Each of the points above is clearly detailed in our templates with areas for you to right-size the processes to fit your institution. Policy and procedures can be uploaded to your Home Page using the Policy and Procedure widget toward the bottom.
Vendor Survey and BIR Tools
Our next key area of focus is assuring you can show examiners you have a complete and accurate vendor inventory. We do this using the Vendor Survey and the Business Impact Report (or BIR) located in CADi. The Vendor Survey allows us to identify any missing vendor contracts or non-contracted relationships and associate a risk rank to each vendor. This will create the vendor inventory. The BIR tool is our method of tracking and managing both missing and incomplete contracts to assure all vendors have clear and accurate contract dates. Your contracts are only added to the BIR after our team has exhausted all our efforts to resolve this contract with your vendors directly and we require your assistance to complete the agreements. The BIR tool is meant to be intuitive and explain what’s missing and what’s the impact if the contract isn’t completed.
Due Diligence Reviews and Risk Assessments
Due diligence reviews are an important focus for examiners. They want to see how you’re managing vendor risk and noting any unacceptable risk. Due diligence review is a critical part of the vendor management process, so time spent reviewing your critical vendors’ documents, at minimum, is going to really help prevent any negative examiner findings. We gather the documents for your critical vendors twice annually and upload them to CADi. Your business owners are responsible for reviewing these documents and making a final assessment with a simple check box. Ideally your business owners should also complete a simple, five-step residual risk assessment in the same section in CADi for each vendor, but completing critical vendor due diligence reviews is a must. Not doing so is a quick way to get a finding.
Vendor Page and Monitoring Notes
Examiners are looking for documentation that business owners are monitoring vendors, especially those critical vendors, on an ongoing basis. Throughout the lifecycle of the vendor relationship, business owners should be looking for and documenting major changes that may impact the risk level of a vendor such as a potential data breach, recurring poor performance or financial risk changes like billing issues or big price increases. Your CADi system makes this easy. Every one of your vendors has its own Vendor Page in CADi, with a notes section where monitoring notes can be documented quickly. We strongly encourage you and your team to use this tool to make notes as issues arise so they’re in one place and easily shared with examiners if they ask.
Exam Planning Checklist
Finally, we want to point to an area in our system where you can pull everything together and export it for proof you’re doing what you state you’re doing in your policy and procedures. In the Reporting section in CADi, there is an Exam Planning tab at the top. This allows you to pull system stats as well as use a checklist to help gather the vetting documentation related to your recent new vendor selection projects. This is how you demonstrate to examiners you have a process for vetting and selecting new vendors and contracting well. Any due diligence reviews you performed, any new vendor checklists or reference checks you completed, and all contract redlines and review notes you or your legal team generated should be bundled up and made ready to share with examiners. Our checklist will guide you through getting this together. Good news, if you are a negotiation client, Maple Street already has deep documentation on our projects that check all of your procedure boxes we can package for you.
Please contact our team at 800-513-6839 if you have an exam scheduled. Our Vendor Compliance Specialists are here to help you prepare, get all of your documentation ready and guide you through having answers ready before examiners begin. During your exam, we can give your examiners temporary access to your CADi system and are happy to answer any questions immediately and even directly with your examiners. We’re here to help, we just need you to ask.