This is something we hear a lot. Obviously, if your regulator has not raised this issue with you, that is a good thing. It is hopefully indicative of the fact that they don’t have a specific concern about your compliance management system in this area.
The difficulty with this is that you can’t wait until it becomes an issue because then it’s probably too late. We’re sensitive to the idea that resources are inherently limited and you want to focus your priorities accordingly. The guidance is out there and on its face it applies to everyone. Your regulator is unlikely, at least in my experience, to take as a response: “You haven’t raised this with us before.” You are expected to know both the law and the applicable supervisory guidance.
I guess what I’d have to say in response to that question is that past results are no indication of future returns. It may be that your regulator will never raise it, but chances are they will and you want to be prepared to respond if and when that happens.
Note: This transcript has been edited from the January 2015 vendor management webinar for clarity and completeness.
Answered By: Ben Olson