A common compliance question comes up often: where in the handbook does it say you should request exam reports on your vendors from their regulatory body?

There’s no formal FFIEC requirement spelling this out directly, but the FFIEC’s TSP Handbook addresses it directly: regulators distribute the open section of a technology service provider’s report of examination to the financial institutions it serves, automatically when that provider receives a composite URSIT rating of 4 or 5, and on request otherwise, provided you can show you held a valid, current contract with that provider as of the exam date.

Two developments have pushed the ROE from a best practice toward something closer to an expectation. In 2012, Don Saxinger, the FDIC’s head of IT risk and a co-author of several of the agency’s IT handbooks, spoke at an ABA telephone briefing about a pattern behind downgraded bank ratings in FDIC IT examinations: banks weren’t requesting copies of their service providers’ own exams, even though regulators already examine those providers directly, and reviewing those findings is a genuinely useful way to keep monitoring vendor risk.

Second, the Federal Reserve issued its “Guidance on Managing Outsourcing Risk” in 2013, stating plainly that you can request the FFIEC Technology Service Provider examination report from your primary federal regulator when the provider delivers information technology services.

When regulators describe something as good monitoring practice and note that you can request it, that’s regulatory language for expect this unless there’s a solid reason not to. You’ll automatically receive the ROE if a vendor scores a 4 or 5, but between Saxinger’s remarks and the Fed’s guidance, the ROE has become a de facto requirement. Waiting to hear from the regulator, or the vendor, isn’t really an option anymore.

That makes this worth adding to your list of vendor controls. Reach out to critical, high-risk vendors and ask whether they’ve had a regulatory examination. If they have, contact the primary federal examiner and request a copy. ROEs come in two sections, confidential and open, and the open section is the only one you’re allowed to see. From there, review the report for anything that might call for additional action.