I received a call from a business systems analyst one afternoon. He said: “We’re in negotiations with a prospective new technology vendor. But the process is going too easily. The vendor is conceding every single negotiating point. Could you review the financial information on the company?” I retrieved the company’s statements from the Internet. The company was losing money, it was insolvent, and its accountants had just issued a “going concern” qualification. I called the systems analyst and conveyed these facts. “Is that bad?” he asked. I again tried stating the information in financial terms. I ended up telling him: “If we pulled up to the company’s headquarters tomorrow, I wouldn’t be surprised to see the lights out and the doors locked.”
Several years ago, vendor due diligence primarily involved conducting background checks, nailing down operational requirements, and negotiating contract language. While evaluating an armored-car company or check-printing vendor once seemed arduous, today’s technology risk managers face such nettlesome questions as these:
* If the bank’s primary telecommunications company declares bankruptcy today, will the phones ring tomorrow?
* If the Web-hosting vendor cuts back on customer support personnel, will the bank’s Web site be down for hours rather than minutes?
* How would the bank know if its transactions-processing vendor were sold to management of questionable character?
Even if a vendor is in poor shape, there may still be compelling business reasons to stay put rather than seek alternative solutions. Shifting front Crafty Crocodile Software to Big Boa Constrictor Systems can take a bite out of your budget as you leave your old vendor and squeeze your resources while installing a new one. Like the man who journeyed the world searching for romance only to return home and fall in love with the girl next door, sometimes the best course of action may be to sit and do nothing.
Indeed, many robust and cutting-edge solutions come from vendors who lack a long track record or have weak financial statements. As one vendor recently lamented:
“I am sorry to hear that your bank has decided not to take advantage of our revolutionary new product. I think that it is a grave mistake to eliminate a vendor from consideration based on a due-diligence process that appears to be unduly focused on number crunching as opposed to seeking opportunity for your bank to gain a competitive advantage.”
Although a less formidable technology vendor may require a smaller contract with a closer maturity date, a stronger vendor may merit a larger, longer-term contract. Moreover, some vendors have capitalized on their financial and operational strength: “Sign a three-year deal rather than an annually renewable contract and save $500,000!”
Evaluating a vendor’s risk profile is troublesome because not all of the risks are financial. National banks are old hands at providing the Office of the Comptroller of the Currency with many indications of direct credit risk to borrowers (risk ratings, repayment histories, independent credit reviews, etc.), but they may be less experienced when it comes to evaluating third parties. In addition to credit risk, the OCC asks banks to consider strategic, reputation, compliance, transaction, and other risks, (1)
While encouraging national banks to use technology in a safe and sound manner, the OCC has stepped up its third-party risk assessment. Recently caught short, one national bank had to devote extensive manpower and financial resources to vendor review. As fate would have it, the solution involved the help of a new database from a technology vendor.
Ironically, while financial institutions are increasingly relying on technology, they also are migrating to progressively more outsourced solutions. As a result, banks are delegating control of the very functions that are becoming more important to their success! Just because the henhouse now has a digital gate doesn’t make the farmer any less responsible when the fox swipes the automatic opener.
eveloping an Effective Vendor Evaluation Solution
What’s needed is a consistent means of identifying, prioritizing, and administering technology vendor risk. Vendors representing higher risk should be tracked more closely. And the solution should be dynamic. An effective vendor risk management system will:
* Rely on teamwork from various functional areas of the bank.
* Determine materiality of the vendor risk.
* Guide evaluation of a vendor’s track record.
* Incorporate financial analysis of the proposed vendor.
* Obtain proper legal review of vendor contracts.
* Integrate existing vendors into the system.
* Establish guidelines for tracking vendors over time.
The Teamwork Solution
Technology solutions are now so pervasive that they require input from throughout the institution. Traditionally, evaluation of new bank products and services included input from audit, compliance, security, privacy, and marketing. Clearly, the best approach to evaluating vendor risk has always been multidisciplinary. But in addition to these traditional areas, technology vendor risk analysis also depends heavily on technology, business systems, operations, finance, and legal review.
* Conduct an analysis of the vendor’s business franchise. How long has the company been in business? Who are the vendor’s main competitors? What is the company’s market share?
* Check the vendor’s business reputation, complaints, and litigation. Does a reference and background check with the vendor’s existing customers indicate any problems?
* Review qualifications, backgrounds, and the reputation of the vendor’s management.
* Establish the vendor’s internal controls, audit, business resumption, continuity, recovery, and contingency plans. Review the vendor’s insurance coverage.
* Review the vendor’s experience in implementing and supporting the proposed product or service. Are there other similar-sized financial institutions as customers?
* Look at the significance of the bank’s contract to the vendor. Does the proposed contract represent a large par of the vendor’s revenues or income?
* Determine whether the vendor has any key subcontractors or enabling counterparties. If the proposed contract is large or material, conduct a check on these additional entities as well.
* Look at the service and support commitment. Does the vendor dedicate a sufficient level of resources to meet the ongoing needs of the bank?
* Evaluate research and development expenditures. Is the vendor’s current research-and development budget large enough to keep the bank’s technology current?
While answering many of the preceding questions is most important before entering a vendor relationship, the bank should revisit this checklist annually for more material contracts. Outsourced technology arrangements should clearly receive the highest level of regular scrutiny. However, as mentioned above, these vendors are generally very strong and the regular review can be conducted in a relatively short time.
Financial Evaluation
What would you think about a vendor who said the following?
By declaring bankruptcy, the company is in the process of reorganizing its finances. The news media will speculate to no end about whether or not we will survive. Regardless of what the financial press and our competitors say, the company has a proud past and we believe that it has a bright future. The company’s new management is in the process of addressing key constituencies, including our employees, supplier’s and customers….
One of the biggest risks in technology vendor relationships is financial stability. Several years ago, it seemed that a telecommunications carrier declared bankruptcy every day. Sometimes, in particularly volatile areas of technology, it seems tough to identify even one vendor with financial staying power.
* Review recent pronouncements front the company’s management. Has the company had any recent earnings warnings? Does it seem that the company has provided any surprises related to its accounting procedures? One of the biggest areas of adverse surprises was revenue recognition. Are sales being converted to cash or are receivable balances rising?
* If publicly traded bond ratings are available, obtain them from Moody’s, Standard & Poor’s, and Fitch. Generally, a senior unsecured debt rating is preferable for a vendor analysis, since the vendor contract usually has no preferential terms or security. Pull a D&B or other commercial credit report on the proposed vendor.
* Update research on the industry.
* Analyze the vendor’s most recent financial statements. What are the vendor’s income statement and cash flow trends? How consistent has the company’s operating performance been in the past?
* Review the company’s balance sheet. Some technology vendors build fortress-style balance sheets to offset the volatility inherent in their industries. Does it appear that the company has enough financial staying power for the length of the contract?
* Evaluate the vendor’s forward commitments. Often, technology vendors have a healthy slug of deferred revenues or maintenance liabilities. Does the company appear to have the operating consistency and liquidity to meet its upcoming commitments?
A company in financial distress is not one to be avoided altogether. However, in attempting to right the ship, the management of a beleaguered vendor often takes steps that have adverse consequences for the bank. If the vendor significantly cuts its staff, the bank faces the risk of a more prolonged disruption in service than is desirable. The bank also faces the possibility that resolving even routine customer service matters will take longer and require more manpower. Often a company in trouble will greatly reduce capital expenditures, resulting in the risk that a competitor could develop better technology.
A company reorganizing in bankruptcy may ironically have better service quality than before: If service quality slips, the company becomes a candidate for liquidation. Nevertheless, a vendor in bankruptcy poses significantly increased risks: Even a company that successfully reorganizes may shed assets or reorient its service delivery.
For these reasons, in cases of financial distress, it is often appropriate to consider substitute vendors. At the very least, once a vendor in financial distress is identified, it is imperative that the bank develops a financial tracking system and an operational contingency plan.
Legal Review
The importance of proper legal review cannot be emphasized enough. Generally, the bank will have an established review system for all contracts, based on various criteria, including dollar size. The last pace of change in technology may warrant legal review if the term of the contract exceeds a relatively short length of time. In addition, certain criteria that raise materiality also increase legal risk.