Our Best Practices To Select, Opt-In & Review Important Vendors

Written by Anthony Diagostino, NCRM, NCCO, CRVPM II, Vendor Compliance

When it comes to Important vendors, it can be challenging to keep track of when they are important to your credit union or community bank. Maple Street’s knowledgeable vendor compliance team is here to help guide you through the process and make short work of your due diligence review. Here’s how to get started:

Choose your Important vendors using CADi

We recommend selecting Important vendors with multi-year contract renewal within the current calendar year. Maple Street provides a list in CADi identifying these vendors. Additional vendors you’ll want to consider include:

• Vendors that haven’t been reviewed recently. We advise 2-Important vendors be reviewed every three years.
• Vendors with frequent or direct access to NPPI.
• Vendors with additional risk concerns, such as performance issues, breach notifications, or legal and financial concerns.

Maple Street’s vendor compliance team will review additional (not recommended) vendors prior to finalizing opt-in and may reach out to you if more information is needed regarding your opt-in choices.

Pro tip: Don’t take on too much

Once you’ve made your selection, we recommend you don’t take on too much at once. In order to be thorough and minimize the workload, target about a third of your 2-Important vendors each year. A risk-based approach is best, as it’s expected by examiners. If due diligence is collected from a vendor, examiners expect that you have put in the time and reviewed the provided information thoroughly.

How to opt-in 2-Important vendors in CADi

CADi is designed to be a useful and time-saving tool for you in preparing your due diligence.

Here’s how to opt-in recommended 2-Important vendors in CADi:

1. Select Vendors from the main navigation pane on the left.
2. Select Opt-In in the top tabbed navigation options.
3. Select Opt-In Vendor for Collection Tracking in the Actions column of targeted vendors.
4. A check mark will confirm successful opt-in.

To opt-in additional, non-recommended, 2-Important vendors in CADi, follow these steps:

1. Select Vendors from the navigation pane on the left.
2. Select Opt-In in the top tabbed options.
3. Use the Advanced Search to locate the non-recommended vendor to opt-in.

4. Select Opt-In Vendor for Collection Tracking in the Actions column of targeted vendors.
5. Maple Street will receive, review, and approve request. VCS may follow-up with questions.

Be sure to mark the open enrollment dates on your calendar:

• Spring Refresh: January 15th – February 14th
• Fall Refresh: July 18th – August 17th

Note: These periods are the only time the CADi Opt-In page is available.

How to review due diligence for a 2-Important vendor

• Documents are available in CADi after refresh release.
• You can review and accept or reject each document.
• Here’s a tip: Look for indications of risk outside tolerance level.
• Adjust scrutiny based on services, risk assessment, criticality to operations, and vendor reputation.
• Street Smart Vendor Review Kits are available to order once opt-in is complete.

Keep in mind documents received may vary. For instance, the SSAE-18/SOC report may not be available based on services provided and vendor size. Also, smaller and privately-held vendors may not provide detailed financials.

It’s our goal to make your due diligence review process as fast and easy possible. That’s why Maple Street offers Street Smart Vendor Review Kits. The SSVRKs contain summaries of all available SOC reports, a financial analysis, which includes three-year trending and insurance comparison, and an OFAC search. They’re built to assist business owners with due diligence assessments and can significantly speed up the time it takes to review each document.

A SSVRK for a 1-Critical or opted-in 2-Important vendor can be ordered at any time throughout the calendar year and will be available in the next due diligence release cycle. They cost $200 per vendor and can be ordered in CADi under the Vendors section in the due diligence tabs. If you are ordering SSVRKs to use in preparing for an exam, let us know by emailing VendorCompliance@maplestreetinc.com and we will work with you to have them ready sooner.

Do you need assistance with due diligence? Give us a call at 321-214-1776 or email info@maplestreetinc.com to learn how we can transform your vendor management into vendor relationship management.