Vendor Due-Diligence Questionnaire Review

Vendor Profile and Engagement Overview

The identifying spine of the relationship - who the third party is, the service it provides, whether it accesses bank systems or customer data, and whether it supports a critical activity - so a reviewer can orient before reading the assessment.

Inherent Risk and Criticality Tier

The risk-based tier that sets how much diligence depth the engagement warrants, weighing criticality, data access, and consumer exposure per the risk-based posture of the 2023 Interagency guidance.

Due-Diligence Control-Area Coverage Checklist

The backbone of the review - one row per required control area from the 2023 Interagency guidance's due-diligence factors, each marked Addressed / Partially / Not addressed with the evidence cited and the gap noted.

Financial Stability Assessment

The third party's financial condition - statements provided, audit opinion, revenue and profitability trend, going-concern flags, and external ratings - because a distressed provider is more likely to fail or exit a critical activity.

Information Security Assessment

The security program - certifications and frameworks claimed, encryption, access controls and MFA, vulnerability and penetration testing, and incident history - assessing whether claims are backed by evidence, not just named.

SOC Report Review

The SOC attestation dissected - SOC 1 vs SOC 2, Type I vs II, trust-services criteria and period, currency and bridge letter, opinion and exceptions, CUECs, and carved-out subservice organizations - the most-relied-on diligence evidence.

Business Continuity and Disaster Recovery

Operational resilience - whether BCP/DR plans exist, the RTO and RPO, the last test date and result, and backup / redundancy - treating an untested plan as a limitation, since a vendor resilience failure becomes the bank's.

Insurance Coverage Verification

Coverage verified line by line - cyber, tech E&O, general liability, crime/fidelity, D&O, workers' comp - with limit vs required minimum, adequacy, expiration, and additional-insured status, flagging warranted coverage that is absent.

Subcontractor and Fourth-Party Risk

The fourth-party map - each material subcontractor, its function, whether it touches bank data, how the vendor oversees it, and any concentration or offshore concern - because the bank's risk does not stop at its direct vendor.

Data Privacy and Protection

How bank and customer data is handled and protected - data types, use limits, applicable privacy regimes (including GLBA safeguards), breach-notification timelines, subprocessors and cross-border transfer, and return / destruction on termination.

Regulatory and Compliance Posture

The third party's regulatory standing - licenses, examinations and enforcement actions, litigation, complaint handling, BSA/AML and sanctions where relevant, and the compliance-management system - a named due-diligence factor in the guidance.

Gap and Exception Log

The consolidated, actionable log - one row per gap, stale attestation, or unanswered item across the whole review, with severity, the guidance reference, and a concrete follow-up to close it.

Overall Risk Rating and Recommendation

The overall residual-risk rating and recommendation - approve, approve with conditions, escalate, or do not proceed - weighing the criticality tier against the open high-severity gaps, so criticality and controls are judged together.