To: Josef Svejk who wrote (8586 ) 12/30/1997 7:53:00 PM From: Judge Read Replies (2) | Respond to of 13949
Year 2000 Safety & Soundness Guidelines Issued by Federal Banking Regulators: Federal Financial Institutions Examination Council Safety And Soundness Guidelines Concerning The Year 2000 Business Risk December 17, 1997 -------------------------------------------------------------------------------- To: The Board of Directors and Chief Executive Officers of all federally supervised financial institutions,providers of data services, senior management of each FFIEC agency, and all examining personnel Background: On May 5, 1997, the FFIEC issued an interagency statement entitled "Year 2000 Project Management Awareness" (Interagency Statement) focusing on the project management process and other significant Year 2000 issues. Although the Interagency Statement provided a detailed overview of the Year 2000 project management process, subsequent discussions with financial institutions, vendors and consultants indicate the need for additional guidance regarding regulatory expectations of senior management and the board of directors concerning the business-wide implications of these issues. Purpose: The purpose of these safety and soundness guidelines is to outline the responsibilities of senior management and the board of directors for addressing the business risks associated with the Year 2000 problem. Senior management and the board of directors should actively manage efforts to plan, allocate resources and monitor progress to correct Year 2000 problems. This includes managing the internal and external risks presented by providers of data processing products and services (vendors), business partners, counter parties, and major loan customers. Summary: These guidelines outline the agencies' expectations in the following areas: The Year 2000 problem is much more than a technology issue; it is an enterprise-wide challenge. Senior management and the board of directors must be actively involved in overseeing internal Year 2000 efforts and monitoring the business risks posed by vendors, business partners, counter parties, and major loan customers. In order to be fully informed and provide effective direction, management must provide the board with status reports, at least quarterly, on the financial institution's Year 2000 efforts. Reporting must include information on the institution's internal Year 2000 corrective efforts and the ability of the institution's major vendors to provide Year 2000 ready products and services. The regulatory agencies are clarifying the Interagency Statement's guidance that suggested financial institutions seek certification from their vendors that their products and services are Year 2000 compliant. Formal certification is not required as it alone is not sufficient to ensure that a product or service would operate properly in the unique environment of many user institutions. Instead, financial institutions should (a) communicate with their vendors and conduct due diligence inquiries concerning Year 2000 readiness and also (b) implement their own appropriate internal testing or verification processes pertaining to these vendor products and services to ensure that their systems and data function properly together. Financial institutions should develop contingency plans for all vendors that service mission critical applications and establish a trigger date for implementing alternative solutions should the vendor not complete its conversion efforts on time. The Year 2000 problem requires an extensive project planning process to ensure that management addresses all business critical issues in a timely and prudent manner. Management must allocate sufficient human and financial resources to the project and should develop/monitor contingency plans for use if Year 2000 corrective efforts do not materialize as expected. To increase the probability of successfully resolving Year 2000 problems, financial institutions should work together to find common solutions by sharing successful practices, common testing methodologies and other non-proprietary information. Enterprise Challenge: The Year 2000 problem presents corporate-wide challenges for financial institutions, their vendors, business partners, counter parties, and customers. However, the regulatory agencies are concerned that many financial institutions view the Year 2000 issue solely as an information system (IS) problem rather than a broader, enterprise-wide challenge. Many institutions may not have adequately funded their Year 2000 programs and may lack the necessary resources to properly address the issue. The board of directors should ensure that senior management is taking an enterprise-wide approach to address Year 2000 problems and must provide sufficient resources to resolve Year 2000 problems. For example: As the Year 2000 will affect most, if not all, of an institution's accounting and risk control systems, there should be close coordination between business units and the institution's operational and risk management functions as conversion programs are executed. Financial institutions relying on vendors for information processing services or products should determine their vendors' progress in resolving Year 2000 issues and the readiness of their own systems and data for appropriate testing. Parties throughout the institution should be involved to coordinate readiness efforts and to develop contingency plans. The interdependencies of a financial institution's information systems will require comprehensive testing of applications with all internal and external systems that share information. Senior management should monitor the testing of all mission critical systems. The approach of the Year 2000 creates potentially adverse effects on the creditworthiness of borrowers. Corporate customers who have not considered Year 2000 issues may experience a disruption in business, resulting in potential financial difficulties affecting their creditworthiness. Financial institutions should develop processes to identify, assess, and control the potential Year 2000 credit risk in their lending and investment portfolios. The regulatory agencies are preparing additional guidance with respect to their expectations of senior management concerning these indirect risks and other important topics. Reporting to the Board: The board of directors must oversee the institution's Year 2000 efforts. Senior management must manage the project on a day-to-day basis, ensuring the appropriate prioritization of resources and establishment of proper benchmarks and time lines. The board must, at a minimum, require quarterly status reports from management that detail the organization's progress in addressing Year 2000 issues. The board should be immediately notified if the project fails to meet critical benchmarks." The full text can be found at ffiec.gov . Best regards, all, Cathleen