Do Your Homework Pass the Exam - PolicyWorks LLCinsight into more than just the company’s products...

21
It’s no secret that due diligence is on the NCUA’s radar. In 2007, the federal agency named vendor management as one of the areas that would soon be receiving extra attention from its Office of Examination and Insurance. Citing an industry-wide lack of business-impact analysis, the NCUA’s Gerry Wyland, a regional information security officer, told 2007 CUISPA attendees, “Credit unions need analysis to identify and quantify risk to upper management. Examiners will be looking at the scope of testing.” Satisfying the NCUA with Vendor Selection Due Diligence By Andrea Stritzke, PolicyWorks Regulatory Counsel* and Brian Scott, TMG Vice President of Sales Do Your Homework Pass the Exam

Transcript of Do Your Homework Pass the Exam - PolicyWorks LLCinsight into more than just the company’s products...

Page 1: Do Your Homework Pass the Exam - PolicyWorks LLCinsight into more than just the company’s products and services. Reading these real-time journals can give your selection team a better

It’s no secret that due diligence is on the NCUA’s radar. In 2007, the federal agency named vendor management as one of the areas that would soon be receiving extra attention from its Offi ce of Examination and Insurance.

Citing an industry-wide lack of business-impact analysis, the NCUA’s Gerry Wyland, a regional information security offi cer, told 2007 CUISPA attendees, “Credit unions need analysis to identify and quantify risk to upper management. Examiners will be looking at the scope of testing.”

Satisfying the NCUA with Vendor Selection Due Diligence

By Andrea Stritzke, PolicyWorks Regulatory Counsel*and Brian Scott, TMG Vice President of Sales

Do Your HomeworkPass the Exam

Page 2: Do Your Homework Pass the Exam - PolicyWorks LLCinsight into more than just the company’s products and services. Reading these real-time journals can give your selection team a better

Satisfying the NCUA withVendor Selection Due Diligence

Introduction 03

Step 01 Pull Out the Calendar 03

Step 02 Answer Your Own Questions First 03

Step 03 Survey the Landscape 04

Step 04 Drafting the RFP 05

Step 05 Analysis 08

Step 06 Contract Negotiations 09

Step 07 Ongoing Evaluation 09

About the Authors, PolicyWorks and TMG 11

Satisfying the NCUA with Vendor Selection Due Diligence

www.policyworksllc.com

Page 3: Do Your Homework Pass the Exam - PolicyWorks LLCinsight into more than just the company’s products and services. Reading these real-time journals can give your selection team a better

Perhaps no other vendor relationship is more critical for a credit union than that with its card processor. Not only does the processor drive a vital revenue-generating activity, it also houses and secures member data — a hot commodity on the ever-intensifying identity black market. It’s easy to see why the performance of due diligence (or lack thereof) in the selection of a card processor is likely to garner the attention of an NCUA examiner.

So, how should your credit union prepare for the selection of a new card processor? What steps should you take and how should they be documented? Which questions should you ask and how should the answers look? Over the next few pages, we’ll give you step-by-step guidance and some practical advice for navigating this crucial course of action — and for doing so within NCUA guidelines.

Step 01 — Pull out the CalendarTo give your team a clear picture of your due diligence project, it will be important to develop a project timeline. Start by pinpointing a target date for fi nalizing the selection of your card processor and work backwards, allowing approximately 30 days for each of the following:

+ RFP Development & Distribution

+ Vendor Responses & Follow Up

+ Analysis & Final Decision

+ Contract Negotiation

Since Wyland and his NCUA colleagues made this declaration, the credit union community — and those who serve it — has come up against some of the most turbulent challenges in history, putting an exclamation point on the NCUA’s call for due diligence in the selection of credit union vendors.

Depending on what is driving your need for a new card processor, you will also need to allow up to 180 days for the implementation of a new program, be that a card conversion or rollout of a new product or program.

Step 02 — Answer Your Own Questions FirstBefore preparing to ask questions of potential processors, it’s important for your selection team to know what they are looking for in the answers. The following is a list of eight questions designed to get your team organized and thinking about the root goals and objectives of your card programs, as well as which questions will be important to ask of potential card processors.

In addition to discussing the following items, it’s a good idea to keep a record of your team’s answers and fi le it away for reference, as well as to demonstrate your credit union’s ground-up commitment to due diligence come examination time.

01. What are you looking for in a new card processor? Your team’s answer should include expectations for all outsourced functions, including the scope of your needs and to what extent the partner will be responsible for the success of your card programs.

02. Who at the credit union will manage and monitor the relationship? Does your team require additional training or expertise to manage the vendor relationship, and if so, will you seek this training from the processor?

03

www.policyworksllc.com

Satisfying the NCUA with Vendor Selection Due Diligence

Page 4: Do Your Homework Pass the Exam - PolicyWorks LLCinsight into more than just the company’s products and services. Reading these real-time journals can give your selection team a better

03. Criticality. How important are card programs to the credit union’s strategic goals? Is it mission critical? What other alternatives exist?

04. How are card programs consistent with the credit union’s values, risk tolerances and business strategies? How critical is it that the card processor understands and adheres to these principals?

05. Address the risks of the activity, product or service as defi ned below:+ Loss of capital if the card program fails+ Loss of member confi dence if the program fails+ Costs associated with training existing or hiring new personnel+ Costs associated with investing in required technology

06. Return on Investment + Attach a list of how each card program will

affect revenue, expenses and net income. + Project how changes in economic conditions

may affect items above. + Attach a cost benefi t analysis for any portion

of the card program, such as a fraud prevention strategy, that does not generate direct income.

07. Insurance Review. Is our credit union’s insurance coverage suffi cient to cover the liabilities related to a card program? Will the card processor carry “key man” insurance or other insurance to protect the credit union?

08. Exit Strategy. Is there a reasonable way out of the relationship if it becomes necessary to change course in the future? Is there another party that can provide any services offi cials deem critical?

Step 03 — Survey the LandscapeWhile it may seem like an obvious step, there are a few tricks to determining which card processors should receive your request for proposal.

Many credit unions choose to use referrals as a basis for selecting potential vendors. And while leveraging the knowledge and fi rst-hand experience of your colleagues is an effi cient idea, it can lead to lost opportunity. What satisfi es one credit union may not satisfy another. Conversely, misunderstandings and other out-of-context anecdotes could cause your credit union to miss out on a vendor perfectly tailored to its expectations.

When turning to colleagues for their advice, be sure to ask follow-up questions to get to the root of a potential processor’s skills, service and expertise.

Contacting your state’s credit union trade association or national trade association for a list of vendors is another way to locate potential card processors. Internet searches can also be helpful when looking for information on vendors that offer a variety of card programs to credit unions.

With the advent of Web 2.0, many credit union processors host blogs that can give potential clients insight into more than just the company’s products and services. Reading these real-time journals can give your selection team a better feel for a potential processor’s philosophies, attitudes and industry expertise.

Using the fi ndings of your research, narrow your fi eld to no more than fi ve and no less than three potential card processors. Reach out to each vendor directly to get the most appropriate contact person and to verify they are currently accepting new clients.

04

www.policyworksllc.com

Satisfying the NCUA with Vendor Selection Due Diligence

Page 5: Do Your Homework Pass the Exam - PolicyWorks LLCinsight into more than just the company’s products and services. Reading these real-time journals can give your selection team a better

Step 04 — Draftingthe RFPRequests for proposals (or RFPs) are a traditional method for gathering information in a digestible format that keeps the incoming data consistent across responding vendors. While the spirit of the document is on-target, execution can be off-base, adding to the RFP’s unfortunate reputation as a superfl uous exercise.

When drafted by a team of credit union individuals who know exactly what they are looking for, the RFP can be an excellent tool for weeding through the information supplied by vendors. In addition, it offers

black-and-white support for a decision as critical as a card processor — a relationship NCUA examiners consider signifi cant to a credit union’s security and risk liability.

Before diving too far into your RFP’s development, ask other departments within the credit union if they are willing to share RFPs they have used in the past. This will help you with the simple (yet often headache-inducing) tasks like layout and formatting. (Alternatively, PolicyWorks has attached a sample RFP to this white paper to help guide you in the development of your own.) Of course, an RFP will not satisfy the requirements of every situation, so it’s always a good idea to seek advice from legal counsel.

05

After you have the foundation of your document prepared, go back to your planning report (Step 2 above) and determine which questions must be answered of the card processors you are considering. Draft the questions in a manner that encourages respondents to answer fully. Avoid questions that can be answered with a yes or no.

After drafting the questions, determine how you will weight the responses. Which categories of questions are most vital to your decision? Over the years, PolicyWorks’ credit union clients have found seven qualities that rise to the top as key in the evaluation of card processors: 1) overall health of the company,2) expertise, 3) security, 4) fraud prevention, 5) customer service, 6) technology and 7) pricing.

Key Quality #01 — Overall Health of the Company

Request three-years of fi nancial statements and analyze these documents for debt-to-equity ratios, debt and income trends, profi t margins and the potential for longevity.

In addition, ask the vendor to identify all parent companies and all subsidiaries. What you are looking for, in addition to the overall fi nancial health of the company, is where card processing falls within the company’s profi tability. Is card processing the main piece of business for the company? Is the processor making a lucrative, revenue-generating contribution to the corporation?

The company’s relationships also give you clues as to the nature of its business. Are subsidiaries and sister companies also involved in the credit union industry? Can this vendor leverage the expertise of affi liated companies, and will that resource benefi t your credit union?

An RFP offers black-and-white support for a decision as critical as a card processor –a relationship NCUA examiners consider signifi cant to a credit union’s security and risk liability.

www.policyworksllc.com

Satisfying the NCUA with Vendor Selection Due Diligence

Page 6: Do Your Homework Pass the Exam - PolicyWorks LLCinsight into more than just the company’s products and services. Reading these real-time journals can give your selection team a better

Sample Questions:

Give a brief description and history of your organization, including the company structure (i.e. publicly traded, privately held, subsidiary of publicly traded, etc.). Identify any parent corporation and/or subsidiaries.

What are the company’s growth expectations over the next fi ve years?

Provide the company’s audited fi nancial report for the last three years. If an audited fi nancial report is unavailable, please provide a year-end balance sheet and income statement.

Key Quality #02 — Expertise

Nailing down a potential card processor’s expertise in the card industry is one thing, but for credit unions, experience and understanding of the credit union philosophy is extremely pertinent when evaluating processors. That’s because card processors are often responsible for everything that happens behind a piece of plastic carrying your credit union’s brand. Every rate increase, fee introduction, fraudulent transaction or customer service inquiry has the potential to jeopardize your good standing with members.

06

Therefore, it’s vital that your RFP includes questions designed to reveal a card processor’s core philosophies and experience. You want to know who they are working with, what they are doing to manage their clients’ reputations and how they are delivering on the promises their clients have made to members.

Sample Questions:

Provide a short summary of the company’s philosophy, product lines and scope of services.

Who is your competition? What differentiates your company’s service(s) from your competitors? What will your company provide that others cannot?

Describe your ideal client.

Please breakdown the number of credit unions you serve as a percentage of the overall total.

Key Quality #03 — Security

Because a card processor will have access to member data, determining the company’s security systems and policies is critically important. Be sure to request a SAS 70 – the annual audit report evaluating a company’s internal control policies and procedures. Request proof of your potential partners’ PCI compliance, as well.

In addition, ask questions to determine the proactive nature of the card processor’s controls. Is the company compliant with all necessary regulations; do they empower offi cers to remain educated on fraud trends; do they perform the necessary background checks, request employee confi dentiality, etc.

These questions should also be asked of any third parties that will have access to your member data. Be sure you understand to which companies your potential partners are outsourcing functions of your contracted services. Does the third party have a confi dentiality agreement? What are the third-party company’s policies and procedures?

Key Qualities to Examine 01 Overall Health of the Company

02 Expertise

03 Security

04 Fraud Protection

05 Customer Service

06 Technology

07 Pricing

www.policyworksllc.com

Satisfying the NCUA with Vendor Selection Due Diligence

Page 7: Do Your Homework Pass the Exam - PolicyWorks LLCinsight into more than just the company’s products and services. Reading these real-time journals can give your selection team a better

Sample Questions:

How does the company protect the privacy of any credit union, credit union member and/or account information that may be collected, maintained or transmitted as a part of your service?

Provide the company’s infrastructure incident response policies and procedures, including but not limited to security breach, virus or network attacks, data tampering and unauthorized access.

Describe the company’s logical security policies and procedures, including but not limited to user ID and password access, authentication, access rights, authority levels and data back-up.

Identify any third-party relationships to facilitate, service, maintain or impact the product or service provided. Provide any related vendor service level agreements or related maintenance contracts covering hardware and software.

Key Quality #04 — Fraud Protection

As criminals learn new and more devious ways of intercepting funds and identities, protection against card fraud is paramount. When determining which card processor will drive your members’ card programs, it is important to collect information on how that company prevents fraud.

Of equal importance is how that prevention impacts your cardholding member base. Aggressive fraud systems will stop fi nancial losses, but they will also stop legitimate transactions along the way. How will the processors you are considering balance member protection with member satisfaction?

Sample Questions:

Describe the company’s fraud prevention program.

Does the company provide customizable fraud prevention strategies tailored to a credit union’s unique membership?

Are fraud analysts in-house or does the company outsource this service? Does the company provide member service and what is the response time for problems reported.

Key Quality #05 — Customer Service

During the planning stage, your team designated a person or team of people as responsible for the vendor relationship and determined whether or not extra training was required. Among card processors, there are different levels of training support. Be sure you are aware how involved your card processor will be in getting staff up-to-speed and assisting with ongoing education.

When problems arise, are you confi dent the processor will be available to assist your staff? What about your members? Ask the kinds of questions that will uncover the processor’s commitment to customer service and describe how your day-to-day relationship will look. Remember that your brand is on the plastic this processor is powering.

07

Armed with the expertise to grow your credit union and the experience to gain member loyalty, card processors have the potential to take your credit union to an entirely new level of profi tability.

www.policyworksllc.com

Satisfying the NCUA with Vendor Selection Due Diligence

Page 8: Do Your Homework Pass the Exam - PolicyWorks LLCinsight into more than just the company’s products and services. Reading these real-time journals can give your selection team a better

Sample Questions:

Does the company provide any training to participating credit unions? If so, is this training provided at the time of implementation and/or ongoing?

Who is responsible for fi rst-line/front-line support to the member? What are your hours of operation for support? How many staff positions are available to assist with support issues?

Key Quality #06 — Technology

At fi rst glance, the products and services of competing card processors will appear similar. Web-based member support, for instance, may have a nearly identical look and feel from one processor to the next. However, it’s how your staff and members will use the interface that is important. How much time does it take to mine the data that’s important to the user? Is it truly user-friendly? Does it tie into your core processing software or back offi ce data systems?

When asking the capabilities questions, dig deeper by inquiring about the use, the fl exibility and the customization of products and services. That’s where you’ll be able to determine which system is best for your credit union.

Sample Questions:

Describe the level of customization available, and specifi cally, how that would be provided to the credit union.

Describe capabilities you have in integrating data and information into our core system or other third-party systems.

Detail any effi ciencies your data entry or back offi ce services will create with the credit union’s systems.

Key Quality #07 — Pricing

Price estimates are generally requested when the credit union has narrowed their prospective fi eld of partners to two. At this point, it’s appropriate to request a proposal specifi c to the products and services of most interest to your credit union.

One thing you may consider is taking this request a step further by asking for an apples-to-apples comparison between card processors. Because vendors refer to different services with different names, it can be diffi cult to determine exactly what your cost will be from one vendor to the next. Additionally, some companies may list pricing in increments and without an associated volume. So, while you may have a clear picture of how much member support will run you by the hour, you may have a diffi cult time determining how much that will cost the credit union over a period of time.

Ask your potential partners to be as specifi c as possible when providing cost estimates, and don’t be afraid to ask questions as you go through the process.

Step 05 — AnalysisNow that you have collected the information, it’s time to digest, compare and ultimately decide which card processor is the best match for your credit union. The goal of the analysis portion of the vendor selection process is to determine your “lead” vendor. This vendor may or may not be the processor you end up signing a contract with. Nonetheless, it is the card processor that appears to most closely match the criteria your credit union has determined it requires.

08

www.policyworksllc.com

Satisfying the NCUA with Vendor Selection Due Diligence

Page 9: Do Your Homework Pass the Exam - PolicyWorks LLCinsight into more than just the company’s products and services. Reading these real-time journals can give your selection team a better

Step 06 — Contract NegotiationsOnce you have identifi ed the lead vendor, request a copy of the processor’s standard contract. If you need assistance reviewing this contract, consider hiring legal counsel with specifi c experience in the credit union industry. This consultant will be able to alert you to red fl ags and make recommendations for any adjustments your credit union may need.

Once you have determined changes that need to be made to your lead vendor’s contract, approach your contact at the card processor with your requirements and negotiate the terms until both parties reach an acceptable contract.

If you are unable to come to an agreement on the contract, it may be time to head back to the RFP pile. Second choices often become fi rst when parties cannot come to a mutual understanding of needs and expectations.

Step 07 — Ongoing EvaluationThe NCUA has indicated that due diligence in advance of hiring a vendor is only a portion of what examiners look for in regards to vendor management. The second piece of their analysis involves ongoing evaluation of risk.

It’s a good idea to include the performance of an annual due diligence review in any vendor contract. While the extent of the reviews will depend on the frequency and criticality of the relationship, requiring your card processor to participate in these reviews will help come review time.

Annual due diligence should include a review of fi nancial and security documents to ensure the vendor can continue to fulfi ll its contractual obligations. This is also a good time to consider any unforeseen issues that arose over the prior year and determine whether or not the vendor is adhering to the contract.

+ Audit rights and requirements (including responsibility for payment)

+ Data security and member confi dentiality (including testing and audit)

+ Business resumption or contingency planning

+ Insurance

+ Member complaints and member service

+ Compliance with regulatory requirements

+ Dispute resolution

+ Default, termination and escape clauses

09

+ Scope of arrangement, services offered and activities authorized

+ Responsibilities of all parties

+ Service level agreements addressing performance standards and measures

+ Performance reports and frequency of reporting

+ Penalties for lack of performance

+ Ownership, control, maintenance and access to fi nancial and operating records

+ Ownership of servicing rights

Items that should be covered in a draft contract include:

www.policyworksllc.com

Satisfying the NCUA with Vendor Selection Due Diligence

Page 10: Do Your Homework Pass the Exam - PolicyWorks LLCinsight into more than just the company’s products and services. Reading these real-time journals can give your selection team a better

10

No other relationship characterizes the need for exceptional due diligence like that with a credit union’s card processor. Armed with the expertise to grow your credit union and the experience to gain member loyalty, card processors have the potential to take your credit union to an entirely new level of profi tability. While it is very often warranted, the trust credit unions place in these partners is immense and should only be given after a period of concentrated analysis.

Scrutiny and attentiveness in every stage of the credit union/vendor relationship is more important now than ever. As our country — and the fi nancial services sector in particular — faces historic challenges, the NCUA has promised to increase its examination of vendor risk assessment. Performing consistent, systematic reviews not only decreases the chances of a catastrophic error at your credit union, it defi nitely increases your chances for an A+ on the NCUA exam.

* The information in this white paper should not be construed as legal services, legal advice, a legal opinion, or in any way establishing anattorney-client relationship.

Any questions regarding the content of this document should be directed to:

Andrea Stritzke PolicyWorksPhone: 515.221.1850E-mail: [email protected]

www.policyworksllc.com

Satisfying the NCUA with Vendor Selection Due Diligence

Page 11: Do Your Homework Pass the Exam - PolicyWorks LLCinsight into more than just the company’s products and services. Reading these real-time journals can give your selection team a better

About the AuthorsAs regulatory counsel for PolicyWorks, Andrea Stritzke continuously tracks state and federal laws and regulations impacting credit

unions, while assisting clients in complying with changes in the law. Andrea delivers many of the regulatory audit products offered by

PolicyWorks and has become a nationally recognized speaker. Prior to joining PolicyWorks, Andrea worked as a judicial clerk for the

Iowa Court of Appeals. She has also worked as a staff attorney for the Nebraska Court of Appeals.

Brian Scott is vice president of sales for TMG (The Members Group). As such, Brian leads a nationwide sales team working with credit

unions to create competitive card programs. Since starting with the company in 1994, he has created profi tability- and portfolio-growth

modeling tools to help credit unions determine the impact of marketing campaigns and promotions. Brian routinely visits over 75 credit

unions each year, sharing insights on the competitive card marketplace.

About PolicyWorksPolicyWorks is an Iowa-based fi rm known for providing solutions to credit unions’ regulatory compliance needs and infl uencing critical

public policy issues through its government affairs services. PolicyWorks has the resources, vision and experience necessary to help credit

unions attain their desired results. PolicyWorks is a wholly-owned subsidiary of the Affi liates Management Company, which is owned by

Iowa credit unions and their members. For more information, visit www.PolicyWorksLLC.com.

About TMGTMG is a wholly-owned subsidiary of the Affi liates Management Company, which is owned by Iowa credit unions and their members.

As a fi nancial and credit union service organization (CUSO), TMG is dedicated to providing innovative and fl exible card processing and

payment solutions to credit unions and fi nancial institutions across North America. TMG’s core products include credit, debit, ATM

and a variety of prepaid solutions, as well as online reporting, item processing, ACH and ALM services. For more information, visit

www.TheMembersGroup.com.

11

© 2009 PolicyWorks 11.09 v1

Satisfying the NCUA with Vendor Selection Due Diligence

Page 12: Do Your Homework Pass the Exam - PolicyWorks LLCinsight into more than just the company’s products and services. Reading these real-time journals can give your selection team a better

< CREDIT UNION LOGO >

R E Q U E S T F O R P R O P O S A L

PROJECT NAME

Credit Union AddressCredit Union AddressCredit Union Address

PURPOSEABC Credit Union is issuing this “Request for Proposal”

to obtain information about outsourcing [NAME OF

PRODUCT OR SERVICE] to a third party vendor. ABC

desires to obtain the above-named product or service

from a company that best meets the current and future

needs of ABC.

DUE DATEYour proposal must be received by [INSERT DATE].

CONTACT and QUESTIONSYour proposal may be sent to [INSERT CONTACT

INFORMATION]. Please submit both an electronic copy

and a printed copy. Questions must be submitted in

writing to [INSERT CONTACT INFORMATION].

PROPOSAL CONTENTS: General Vendor Information

Financial Information

Operational Information

System & Security Information

References

Pricing

Page 13: Do Your Homework Pass the Exam - PolicyWorks LLCinsight into more than just the company’s products and services. Reading these real-time journals can give your selection team a better

R E Q U E S T F O R P R O P O S A LR E Q U E S T F O R P R O P O S A L

GENERAL VENDOR INFORMATION

1. Company Name:

Address: State: Zip:

Telephone Number: Website:

Appropriate Contact:

2. Give a brief description and history of your organization, including the company structure (i.e.: publicly traded, privately held, subsidiary of publicly traded). Identify any parent corporation and/or subsidiaries, if appropriate.

3. Company’s state of incorporation:

All states where it is authorized/registered/licensed to do business:

4. Year the company was established: 5. Company’s owners and directors:

6. Provide a short summary of the company’s philosophy, product lines and scope of services.

Page 14: Do Your Homework Pass the Exam - PolicyWorks LLCinsight into more than just the company’s products and services. Reading these real-time journals can give your selection team a better

R E Q U E S T F O R P R O P O S A L

7. A statement as to whether the company is subject to any law enforcement or governmental proceeding or investigation (including proceedings or investigations involving individual officers, directors, or employees), and details of any proceedings or investigations.

8. A statement detailing whether the company is currently involved in any litigation, and, if so, any details about the litigation, including the status, parties, basis for suit, and court where filed.

9. Are there any liens or judgments pending against the company in any state where you do business? If yes, please explain.

10. A statement regarding the company’s involvement in litigation that has occurred in the preceding five years. Please provide any details about the litigation, including parties, basis for suit, court where filed, and resolution of litigation.

11. Please describe your ideal client and how your services assist this client in meeting their strategic objectives.

Page 15: Do Your Homework Pass the Exam - PolicyWorks LLCinsight into more than just the company’s products and services. Reading these real-time journals can give your selection team a better

R E Q U E S T F O R P R O P O S A L

12. Describe your company’s philosophy around creating new technologies and implementing new services for your clients.

13. Please breakdown the number of credit unions you serve as a percentage of the overall total:

14. What are the company’s growth expectations over the next five years?

15. Is any single customer more than 20% of your total business? Do your top four customers comprise more than 50% of your total business?

16. Who is your competition? What differentiates your company’s service(s) from your competitors? What will your company provide under this possible alliance that others cannot?

17. Provide Certificates of Good Standing from the Secretary of State in the state(s) where the company is incorporated.

18. Provide proof of the company’s general liability, personal and real property, product liability, errors and omissions, key-man, directors and officers, worker’s compensation, and other insurance.

19. Describe the company’s human resource policies & procedures, including, but not limited to: background checks, employee confidentiality, and termination procedures as they relate to physical and data security.

attached

attached

Page 16: Do Your Homework Pass the Exam - PolicyWorks LLCinsight into more than just the company’s products and services. Reading these real-time journals can give your selection team a better

R E Q U E S T F O R P R O P O S A L

FINANCIAL INFORMATION

20. Provide the company’s audited financial report for the past three years. If an audited financial report is unavailable, please provide a year-end balance sheet and income statement for the last three years.

OPERATIONAL INFORMATION

21. Identify any third-party relationships used to facilitate, service, maintain, or impact the product or service provided. Provide any related vendor service level agreements or related maintenance contracts covering hardware and software.

22. Provide a copy of the company’s standard services agreement.

23. Describe the company’s current implementation process beginning at the point of receiving a signed agreement [or purchase order] for the product/service. Provide a typical project plan.

24. a. Does the company provide any training to participating credit unions?

If so, is this training provided at the time of implementation and/or ongoing?

b. What does the training cover and how many employees are included in the training?

# employees

c. Is the training done on-site or remotely?

d. Who is responsible for providing the training?

e. Is there an additional cost to the credit union?

f. Proposed number of days for training:

attached

attached

attached

attached

Page 17: Do Your Homework Pass the Exam - PolicyWorks LLCinsight into more than just the company’s products and services. Reading these real-time journals can give your selection team a better

R E Q U E S T F O R P R O P O S A L

25. Describe the billing process for the products/services, as well as any cost increases.

26. a) Describe how the credit union staff will use your company’s systems or software to service cardholders. b) Describe how the credit union’s cardholders will access their own card account information.

27. Describe any reporting systems available from your company.

28. a) Describe capabilities you have in integrating data and information into our core system or other third-party systems. b) Detail any efficiencies your data entry or back office services will create with the credit union’s systems.

29. Describe the service options available to the credit union, such as member service, fraud disputes, lost/stolen, payment processing, etc.

Page 18: Do Your Homework Pass the Exam - PolicyWorks LLCinsight into more than just the company’s products and services. Reading these real-time journals can give your selection team a better

R E Q U E S T F O R P R O P O S A L

30. Describe the level of customization available and specifically how that would be provided to the credit union.

31. Describe the company’s capabilities in helping credit unions grow their card programs.

32. Describe the company’s capabilities around managing and protecting the credit union from card fraud.

33. a. Who is responsible for first-line/front-line support to the member/user?

b. What contact methods would a member/user use for support (i.e., IVR, online, live agent)?

c. What are your hours of operation for support?

d. Is there an additional cost to the credit union for this support?

e. Do you support bi-lingual capabilities?

f. How many staff positions are available to assist with support issues?

g. What is the response time for problems reported: 1) during regular hours:

2) off hours:

Page 19: Do Your Homework Pass the Exam - PolicyWorks LLCinsight into more than just the company’s products and services. Reading these real-time journals can give your selection team a better

R E Q U E S T F O R P R O P O S A L

SYSTEM and SECURITY INFORMATION

34. How does the company protect the privacy of any credit union, member and/or account information that may be collected, maintained or transmitted as part of your service?

35. List the company’s pertinent data center locations where the credit union’s data is stored, processed, and/or located in physical or electronic form. Explain all features of the data center, including but not limited to network security, backbone connectivity, core network, and operations.

36. Does the company perform an independent review of your internal controls or risk assessments on systems regularly, at least annually? Please provide a copy of your latest audit or assessment.

37. Provide a copy of the company’s relevant SAS 70 review documentation.

38. Provide the company’s infrastructure incident response policies and procedures, including but not limited to security breach, virus or network attacks, data tampering, and unauthorized access.

39. Does the company provide credit unions with a Service Level Agreement? If yes, please provide a copy of a sample agreement.

40. Does the company have a written business continuity (BCP) or disaster recovery plan (DRP) to ensure that all systems (including essential non-systems) and related business processes can be recovered in a timely manner? If yes, please provide a copy.

41. Describe the company’s logical security policies and procedures, including but not limited to user ID and password access, authentication, access rights, authority levels, and data back-up.

attached

attached

attached

attached

attached

Page 20: Do Your Homework Pass the Exam - PolicyWorks LLCinsight into more than just the company’s products and services. Reading these real-time journals can give your selection team a better

R E Q U E S T F O R P R O P O S A L

42. Does the company have records management policies and procedures, including but not limited to electronic and hard-copy formats retention policies, and destruction procedures? Please enclose a copy of these policies/procedures.

43. Does the company have information security policies and procedures including, but not limited to physical security and environmental controls? Please enclose a copy of these policies/procedures.

44. Provide the company’s most recent network penetration testing results, including the date of the test, noted exceptions, exceptions addressed, date of next test, and certifications (i.e., Cybertrust, TruSecure, Internet Security Systems).

45. Illustrate or describe the company’s firewall protection.

attached

attached

attached

Page 21: Do Your Homework Pass the Exam - PolicyWorks LLCinsight into more than just the company’s products and services. Reading these real-time journals can give your selection team a better

R E Q U E S T F O R P R O P O S A L

REFERENCES

List three current clients as references who may be contacted. List two former clients who have discontinued service in the past three years. Include a contact name, position, telephone number and email.

CURRENT REFERENCES

Name:

Position:

Telephone:

Email:

Name:

Position:

Telephone:

Email:

Name:

Position:

Telephone:

Email:

FORMER CLIENTS

Name:

Position:

Telephone:

Email:

Name:

Position:

Telephone:

Email: