Processes are outsourced or performed at the customer location. Evaluate the use of in-house and outsourced data processing systems to support retail payment products and processes. Consider: How stable are existing systems. How current are existing systems. Whether there is adequate capacity for current and planned transaction volumes. Whether the institution uses leading edge technologies or only mature technologies. To what extent are systems outsourced. Whether outsourcing arrangements are governed by contracts and service level agreements. Whether vendors are considered to be industry-recognized leaders. Objective 2: Establish the scope and objectives of the examination of the retail payment systems function. Review previous reports of examination for comments relating to retail payment systems. Review: Regulatory reports of examination, including consumer and compliance information. Prior examination work papers, including any documentation obtained through on-going supervision. Internal control self-assessments completed by business lines. Internal and external audit reports, including annual attestation letters. Regulatory, audit, and information security reports from service providers. Trade group, bankcard company, interchange, and clearing house documentation relating to services provided by the financial institution, particularly the NACHA required annual security audit and bankcard company self assessments. Supervisory strategy documents, including risk assessments. Review past examination reports for comments relating to the internal control institution’s environment and technical infrastructure. Review: The architecture, including processing outsourcing arrangements. institution’s processing Internal controls, including physical and logical access controls in the data entry area, data center, and item processing operations. Electronic Funds Transfer (EFT)/Point of Sale (POS) network controls.
Processes are outsourced or performed at the customer location. Evaluate the use of in-house and outsourced data processing systems to support retail payment products and processes. Consider: How stable are existing systems. How current are existing systems. Whether there is adequate capacity for current and planned transaction volumes. Whether the institution uses leading edge technologies or only mature technologies. To what extent are systems outsourced. Whether outsourcing arrangements are governed by contracts and service level agreements. Whether vendors are considered to be industry-recognized leaders. Objective 2: Establish the scope and objectives of the examination of the retail payment systems function. Review previous reports of examination for comments relating to retail payment systems. Review: Regulatory reports of examination, including consumer and compliance information. Prior examination work papers, including any documentation obtained through on-going supervision. Internal control self-assessments completed by business lines. Internal and external audit reports, including annual attestation letters. Regulatory, audit, and information security reports from service providers. Trade group, bankcard company, interchange, and clearing house documentation relating to services provided by the financial institution, particularly the NACHA required annual security audit and bankcard company self assessments. Supervisory strategy documents, including risk assessments. Review past examination reports for comments relating to the institution’s internal control environment and technical infrastructure. Review: The institution’s processing architecture, including processing outsourcing arrangements. Internal controls, including physical and logical access controls in the data entry area, data center, and item processing operations. Electronic Funds Transfer (EFT)/Point of Sale (POS) network controls.
ffiec_itworkprogram_retailpaymentsystems.docx