Due Diligence and Ongoing Monitoring

Hello TPRM community,

I work for a commercial Bank and was recently introduced to a financial spreading software program.

Do any of your banks use these software programs? How do you classify their inherent risk?

I am trying to figure out if borrower/client NPI is shared. 

Any help would be greatly appreciated.

Hi there,

For the benefit of other members, let me briefly explain what financial spreading is. Financial spreading is a technique used by financial institutions to analyze and evaluate a borrower's financial health. It involves breaking down financial statements and assigning values to individual line items to determine key financial ratios such as debt-to-income ratio, liquidity ratio, and profitability ratio. This helps lenders make informed decisions about whether to approve or deny a loan application and what interest rate to charge.

Because the software is meant to gather a customer's provided financial data and transfer it into the program for analysis, there is quite a bit of confidential information (NPI) being accessed, processed, and stored.

From a risk rating perspective, this activity would typically result in a high-risk rating. However, the best way to ensure that any third-party product or service is accurately risk-rated is to make sure your TPRM program utilizes a standardized inherent risk assessment. This is not only best practice but will eliminate any guesswork and give you proper documentation for your risk ratings to be used in an audit or regulatory exam.

I have included this inherent risk assessment resource that I hope you will find helpful.

Inherent Vendor Risk: Sample Questions and Next Steps

If other members have thoughts on this topic, we would love to hear from you.

Hello TPRM community,

I work for a commercial Bank and was recently introduced to a financial spreading software program.

Do any of your banks use these software programs? How do you classify their inherent risk?

I am trying to figure out if borrower/client NPI is shared. 

Any help would be greatly appreciated.