SPECIALTY EXAMINATIONS Flashcards
IT
IS work program should be used when?
- No testing and vendor supported
- Some testing requires RD approval if >$300MM
- ATMs, POS, ACH any bank;
- Serviced by outside vendor;
- Not used if the bank services another bank
IT
What are the 4 IS components? MADS
- Management
- Audit
- Development and Acquisition
- Support and delivery
IT
What is the IT Composite 1 Rating?
- Exhibit strong performance in every respect and generally have components rated 1 or 2;
- IT Weaknesses are minor in nature and easily corrected during the normal course of business;
- Risk management processes provide a comprehensive program to identify and monitor risk relative to the size, complexity and risk profile of the entity;
- Well defined strategic plans are fully integrated throughout the organization allowing management to quickly adapt to changing market, business and technology needs of the entity;
- Management identifies weaknesses promptly and takes appropriate corrective action to resolve audit and regulatory concerns;
- The financial condition of the service provider is strong and overall performance shows no cause for supervisory concern.
IT
What is the IT Composite 2 Rating?
- Exhibit safe and sound performance but may demonstrate modest weaknesses in operating performance, monitoring, management processes or system development;
- Generally, senior management corrects weaknesses in the normal course of business;
- Risk management processes adequately identify and monitor risk relative to the size, complexity and risk profile of the entity;
- Strategic plans are defined but may require clarification, better coordination or improved communication throughout the organization;
- Management anticipates, but responds less quickly to changes in market, business, and technological needs of the entity;
- Management normally identifies weaknesses and takes appropriate corrective action, although greater reliance is placed on audit and regulatory intervention to identify and resolve concerns;
- The financial condition of the service provider is acceptable and while internal control weaknesses may exist, there are no significant supervisory concerns
- Supervisory action is informal and limited.
IT
What is the IT Composite 3 Rating?
- Exhibit some degree of supervisory concern due to a combination of weaknesses that may range from moderate to severe;
- If weaknesses persist, further deterioration in the condition and performance of the institution or service provider is likely
- Risk management processes may not effectively identify risks and may not be appropriate for the size, complexity, or risk profile of the entity;
- Strategic plans are vaguely defined and may not provide adequate direction for IT initiatives;
- Management often has difficulty responding to changes in business, market, and technological needs of the entity
- Self-assessment practices are weak and are generally reactive to audit and regulatory exceptions;
- Repeat concerns may exist, indicating that management may lack the ability or willingness to resolve concerns;
- The financial condition of the service provider may be weak and/or negative trends may be evident;
- While financial or operational failure is unlikely, increased supervision is necessary;
- Formal or informal supervisory action may be necessary to secure corrective action.
IT
What is the IT Composite 4 Rating?
- Operates in an unsafe and unsound environment that may impair the future viability of the entity;
- Operating weaknesses are indicative of serious managerial deficiencies;
- Risk management processes inadequately identify and monitor risk, and practices are not appropriate given the size, complexity, and risk profile of the entity;
- Strategic plans are poorly defined and not coordinated or communicated throughout the organization;
- Management and the board are not committed to, or may be incapable of ensuring that technological needs are met;
- Management does not perform self-assessments and demonstrates an inability or unwillingness to correct audit and regulatory concerns;
- The financial condition of the service provider is severely impaired and/or deteriorating;
- Failure of the financial institution or service provider may be likely unless IT problems are remedied;
- Close supervisory attention is necessary and, in most cases, formal enforcement action is warranted.
IT
What is the IT Composite 5 Rating?
• Exhibit critically deficient operating performance and are in need of immediate remedial action;
• Operational problems and serious weaknesses may exist throughout the organization;
• Risk management processes are severely deficient and provide management little or no perception of risk relative to the size, complexity, and risk profile of the entity;
• Strategic plans do not exist or are ineffective, and management and the board provide little or no direction for IT initiatives;
• As a result, management is unaware of, or inattentive to technological needs of the entity;
• Management is unwilling or incapable of correcting audit and regulatory concerns;
• The financial condition of the service provider is poor and failure is highly probable due to poor operating performance or financial instability;
Ongoing supervisory attention is necessary.
TRUST
What is the definition of a trust?
- Fiduciary relationship in which one person is the holder of the title to the property subject to an equitable obligation to keep or use the property for the benefit of another.
- Trustees can be individual or corporate, but the person named must have the legal capacity to hold the property.
TRUST
What are the Uniform Interagency Trust Rating System (UITRS) components (Hint: MOECA)?
- Management
- Operations, Internal Controls, and Auditing
- Earnings
- Compliance
- Asset Management
TRUST
What is the purpose of a trust examination?
- Determine if the banks operations or administration of accounts have given rise to possible or contingent liabilities (damages from lawsuits due to inappropriate handling of trusts), and
- To assess whether there are any direct liabilities or estimated losses (identify risk to the bank’s capital position).
TRUST
When do Earnings not need to be rated?
• Earnings do not need to be rated if the department has less than $100MM in TA as of the examination date.
TRUST
What are the minimum requirements from Statement of Principles of Trust Department Management?
- Establish Trust Department
- Separate Operations
- Separate Books
TRUST
What are the Reporting and Monitoring Procedures form SOP Trust Department Management?
- Trust Officer
- Trust Committee
- Written Policies
- Legal Counsel
- Internal Controls
- Audit Program
- Review Committee Reports
- Review Trust Exam Reports
TRUST
State nonmember gets consent from ______ to exercise trust powers, and the ______ grants these powers.
- FDIC
* State
TRUST
Requirements of the Trust Committee: (7)
- 3 directors of bank & at least 1 who is not an active bank officer;
- Quarterly meetings;
- Approve & document the opening of accounts, all purchases/sales, or changes in trust assets, and the closing of trust accounts;
- Provide for comprehensive review of all new accounts;
- Provide for a review of the trust department account at least annually;
- Keep comprehensive minutes;
- Make periodic reports to the BOD of its actions