Forward Bank in Marshfield, Wis., used to rely on Excel spreadsheets and Word documents for vendor management. Lori Schutz, vice president, project manager, said the approach lacked consistency. The process became even clumsier as the bank added new branches and increased the number of vendors being managed. On top of everything, vendor management became more of a focus during regulatory exams and audits.
When Schutz became responsible for overseeing vendor management, she felt like the $879 million bank needed to outsource the function entirely: “It’s hard to be an expert at something when you don’t do it that often,” she said, hoping to benefit from a standardized process that would come with vendor management technology.
Community banking has gotten complex: Today a banker needs a wide breadth of knowledge in everything from regulatory compliance to the latest technology trends. And the demands for depth of knowledge continue to increase.
In the past, vendor management may have been a small part of an employee’s job description. Now, the average community bank with less than $500 million in assets has anywhere from 100 to 800 vendors. Banks up to $5 billion may have more than 1,000 vendors. As a result, vendor management has morphed into a complex function, requiring a wide range of banking expertise and project management skills.
At some point, community bankers may decide that vendor management is too difficult to handle internally.
Lack of expertise, resources are tipping points
Western State Bank in Devils Lake, N.D., used a vendor management solution, but it wasn’t robust enough. Mark Jensen, senior vice president and risk officer, said the $1.7 billion bank was looking for a product with better tracking and reporting. Before technology, the bank was also using internal spreadsheets.
When Jensen was first getting his feet wet with vendor management, about four years ago, he started exploring a system that would not only allow the bank to catalog and organize tasks but also be more interactive in managing the risk rating of different vendors. He noted that the bank knew it needed to improve its process. “You need to make use of whatever tools are available to lighten your load and shorten the work,” Jensen said.
Rafael DeLeon, senior vice president of industry engagement at Ncontracts, a vendor and risk management solution provider, has been around banks since he was a child and seen the changes firsthand. His father was a banker and he started working at a bank in high school. He spent 32 years at the OCC and now serves on the board of directors for MainStreet Bank in Fairfax, Va. “Ten or 20 years ago, people weren’t partnering with as many vendors,” he said.
DeLeon thinks that the need for differentiation and the speed of digitization over the past five years in particular have posed a challenge to banks in managing the risk of third parties. The relationships have broadened in “scale, scope and complexity of these relationships.”
The tipping points for outsourcing vendor management are varied across community banks. Complexity and volume are certainly common, but talent shortages have been a big reason lately. Turnover creates exposure for banks: If the only knowledgeable person leaves, there can be a large gap in vendor management. “There are not enough people to fill any role,” Jensen said. “Good luck finding someone who understands vendor management in a bank setting.”
Benefitting from efficiency, collective expertise
Forward Bank and Western State Bank create reports from their vendor management partners for their boards. “We can log into the system, click on a button, and produce a report on our critical vendors, or any vendor sorted by vendor owner, or maybe recency of review,” Jensen said. He also reports back to their enterprise risk committee. “We can help with our vendor management policy and build out those processes with some best practices in the industry that I think are really helpful.”
Forward Bank produced monthly vendor management reports when it relied on spreadsheets for vendor management. Since implementing a technology solution, the bank moved to a quarterly cadence. Now that the board is comfortable with the process, reports are only created annually. Schutz said that it “brings a very strong level of consistency to vendor management.”
Outsourced vendors can also provide banks with alerts, such as a vendor acquisition, legal trouble, financial issues or a data breach. Western State Bank reviews the alerts internally and decides if it wants to change the risk rating for a vendor. Collective monitoring means that when information about a vendor becomes available, all client banks that use that vendor are informed.
Banks also benefit from external expertise that they don’t have internally. “How often are these banks reviewing touch points on vendor management, and what do periodic reviews look like?” DeLeon wondered. “Even at a minimum, if somebody was just looking at vendor management once a year … that’s a lot of information to digest.”
Forward Bank still assigns an internal vendor owner, but relies on Ncontracts for its vendor review. “Our internal people have just welcomed the fact that we’ve partnered with [Ncontracts] on the critical vendors [and] use their expertise in reviewing documents,” Schutz said. While internally, the bank may only review lengthy and detailed documentation from a core provider once a year, an outsourced vendor management company reviews the documentation on behalf of many client banks, year after year. The shared knowledge benefits the bank, according to Schutz: “They have collectively pulled together all the best practices.”
Vendor management evolves
Outsourcing vendor management has not only improved efficiency and consistency, but improved processes overall. Western State Bank’s vendor management policy has grown and matured. It has evolved from a two-page summary into stratified identification of vendor risk and more details about items that the bank needs to track, such as entity controls and a catalog of fourth-party vendors.
The bank is also looking to improve its vendor onboarding, review of contracts before they’re signed, and vetting of vendors. The bank has created a list of minimum contract requirements it would like to see for new vendors and pays more attention to service agreements. This level of scrutiny is not used for all vendors, but those that may have access to the bank’s data would involve more components from the bank’s checklist.
Forward Bank uses Ncontracts for tracking prospective vendors. The bank can add RFPs, due diligence information, and any questions asked to compare vendors. Once a vendor is selected and becomes “active,” the others stay in the system as prospects. Schutz said that if the bank ever wants to change vendors, she can go back and look at other vendors that were considered.
With the standardized process of reviewing vendors, Jensen points out that regular assessment is an opportunity to visit with internal vendor owners: Is it time to look at different options? Are they fine with renewing as-is? Do they want to change the renewal? Determining the bank’s satisfaction at renewal is still a work-in-progress. “That’s a process that’s building out for us,” Jensen said. “That’s the goal.”