Independent Banker - May 2018 - 36

ISO Training
Summer
Series
ATTN:
Information Security Officers
Stay cool this summer during this
six-part training series designed for
individuals at community banks
filling the ole of Information
Security Officer.
PORTFOLIO
adjustments in a timely manner.
The keys to keeping up with compliance
requirements include:
Q understanding each requirement.
Read announcements of proposed
or final rules completely and pay
attention to coverage, definitions of
key terms, disclosure requirements
and timing rules
Q staying abreast of changes to the
business model of the bank, its policies,
and its products and services.
Complimentary
webinar sessions
include:
Financial Institution
Regulatory Structure
and the role of ISO
Governance and Risk
Management
Data and Physical Security
Vendor Management
Business Continuity Planning
and Incident Response
Security Testing and
Assurance
Register at:
conetrix.com/ISO-sum
Ask yourself: Do the requirements,
or any part of them, apply to
your bank and its products or services,
including those performed by
third-party vendors? If yes:
Q Identify the departments, stakeholders,
policies, procedures, systems
and documentation that the change
or requirements might affect.
Q For regulatory proposals, communicate
the potential impact to key
stakeholders and provide updates
as the proposals evolve.
Q For interim or final rules, gain a solid
understanding of the requirements,
note the effective dates of changes
and, working backward, estimate
key benchmark dates. Communicate
with key stakeholders to begin steps
for the project: planning, implementing,
training, testing for effectiveness
and making adjustments.
Presented by:
If the answer is no, create a brief
record of your assessment process
and conclusion. If it is possible that
future events might cause your bank to
become subject to the requirement(s),
ensure processes are in place, either
through compliance monitoring procedures
or those of internal audit, to
periodically check for coverage.
Sampling matters
An effective compliance management
system (CMS) must include methods
to test the completeness, accuracy
and effectiveness of compliance functions.
Policies and procedures require
comprehensive periodic reviews.
However, using a representative sample
is generally an effective method
of identifying errors or omissions in
transactions and records. The results
of sampling can guide subsequent
actions, such as training, operational
changes and re-looks.
How much sampling is enough?
What constitutes a representative
sample will be determined by your
organization's structure, its practices
and its products and services. Sampling
is generally conducted for new
transactions or records that have
been created since the most recent
Compliance
management
must be a living,
changing process.
review of the target area. Areas in
which problems have occurred in the
past generally require more frequent
reviews and heavier sampling that
aims to confirm that previous corrective
actions have been effective.
Create a sampling plan that is based
on your community bank's products
and services, and its exposure to regulatory
risk. The bank's compliance risk
assessment and a review of any previous
testing results are good places to
start. What type(s) of loan products are
listed on the risk assessment? Residential
mortgage loans? Then residential
mortgage loans should be included in
the scope of the sampling plan.
From there, break the samples down
further to closely represent the bank's
lending practices. The sample for your
bank may or may not include loans
http://www.conetrix.com/ISO-sum
Independent Banker - May 2018

Table of Contents for the Digital Edition of Independent Banker - May 2018
