I.

FDIC

_________

FRB

_________

NCUA

OCC

_________

VII.

Comments:

Regular off-site or informal reviews (generally at least once between examinations) to confirm the risk ratings and assigned examination priority and maintain ongoing communication with the service provider. Reviews should focus on identifying significant changes in management and risk management, in the quantity of inherent risk to supervised financial institutions, or in products or services affecting financial institutions, and following up on any issues or concerns.

Regular review of monitoring and oversight by client institutions and user groups.

A concise product/service review document will be provided (or updated) annually for internal use by regulatory examiners in assessing controls in place at client institutions.

Same as above for Priority A.

Product/service review document may be combined with off-site/informal review documentation.

GENERAL INSTRUCTIONS FOR COMPLETING EXAMINATION PRIORITY RANKING SHEETS:
Only one “Examination Priority Ranking Sheet” (EPR) should be completed for each TSP, regardless of the fact that the TSP may have multiple processing sites. Although risk levels at individual processing sites may vary, the EPR should reflect the aggregate risk posed by the company’s activities.

The Agency-In-Charge (AIC) will coordinate the risk ranking of each TSP under its supervision. The ERP ranking form should not be modified or edited in any way.

At the conclusion of each examination the AIC is responsible for

	Completing Sections I through V of the EPR for each TSP.
	-	Section III Business Line Risk Ranking—If a business line is checked in more than one risk ranking category, the AIC should assess all of the business lines and risks together before arriving at an overall Business Line Risk Rank.
	-	Section IV Service Provider Risk Category—If factors are selected from more than one risk-ranking category, the AIC should assess all of the risks before arriving at an overall “Service Provider Risk.” Rating one risk factor “Higher Risk” does not automatically result in the TSP having an overall “Higher Risk” rank.
	Distributing copies of the completed EPR to its counterparts at the other FFIEC agencies.
	Collecting from its counterparts the EPRs indicating agency agreement/disagreement, consolidating the findings under section VI, and resolving any priority disagreements to the extent possible. The AIC should retain all documentation supporting the priority designation and agency agreement/disagreement. The FFIEC IT subcommittee may request submission of the supporting documentation on a random basis or in instances of agency disagreement.
	Documenting the basis for the disagreement in the comment, section VII, for those rare occasions when a resolution cannot be reached.
	Forwarding the completed ERP to the other agencies’ representatives.

Agency representatives receiving EPR from the AIC are responsible for

	Reviewing sections I through V;
	Completing sections VI and VII as applicable;
	Returning the completed form to the AIC by the requested response date; and
	Retaining a copy for their records.