Beyond Spreadsheets: Vendor Management Ideas

In their move to acquire specialized capabilities, community banks have realized great value to themselves and their customers by partnering with third parties. But that value currently comes with a high cost in administrative oversight.

“Most community banks of our size are going to have over 100 vendors that they use,” says Chris Doyle, president and CEO of $2.4 billion‑asset Texas First Bank in Texas City, Texas. “You can understand what a formidable task it is to manage the risk related to 100 different partners.”

At the same time, regulators are tightening expectations of what community banks should monitor. 

 

“Regulators want us to look at risk ratings and vendors every single year, so we have to look at the documentation that goes along with that,” explains Christine Niskanen, chief risk officer and SVP for $705 million-asset Bank of Elk River in Elk River, Minnesota. “That’s a lot of documents to cull through.”

On top of that, most vendors have vendors. “Fintechs use a lot of fourth-party providers to handle parts of their services,” Doyle notes.

Michael Carpenter, VP of risk management for risk and compliance management software provider Ncontracts, argues that the multiplying levels of vendors—a result of the increase in demand for digital products and the expectations of consumers for speed of action—signal that banks and vendors alike must focus on the type of data, the flow of data as the primary factor and the parties involved in data movement, when evaluating vendor management protocols. 

“How data moves and where it moves to, that’s where we’re going to have to go as an industry,” he says.

For most banks, software is the solution for handling so much data, and increasingly, software incorporates artificial intelligence (AI). 

“It’s exciting to see the development of solutions and software tools that use AI to scan the environment for particular details and find out what a banker needs to know,” says Wayne Miller, ICBA’s executive vice president and chief innovation officer. “It’s very customizable and returns information rapidly. We can use software to support the process. It can develop documents that are effective for compliance or remind a bank when we need to re-up the vendor.”

Niskanen is equally positive about the benefits of software. The Bank of Elk River works with Ncontracts to administer vendor management. “[Software] helps us do everything from initial risk rating to gathering information about the vendor and staying ahead of renewal dates,” she says. “A big benefit of the software is that it tracks the due diligence process. It’s all on a dashboard, and we can spread the work out through the year.”

The Bank of Elk River employs a full-time information security specialist who is the community bank’s go-to for vendor administration, but Niskanen plans to train more business managers. She believes this will help managers evaluate vendors and find opportunities for vendor consolidation. 

“We’d like managers to have good insight into what vendors are doing,” Niskanen says. “If we give them data to do that analysis, they have an opportunity to cull providers that are redundant or no longer necessary. Software is going to help us with this.”

Clarence Chio, cofounder and CEO of Coverbase, an ICBA ThinkTECH alumnus that automates third-party risk assessments, emphasizes that AI is not a substitute for human judgment but can relieve time-consuming repetitive tasks. 

“AI will not take over the risk management duties,” he says. “More human skills and expertise are of great value. However, it can take over the tedious tasks that add up to a big part of the administrative work, thus using the time more efficiently for risk discovery.”

The need for an extra hand

Chio observes that vendor management requirements arose rather suddenly in banking environments, and the industry has tended to improvise its response. 

“Presently, vendor management functions largely drift to risk management professionals,” he notes. “However, in most cases, more than 90% of these professionals’ time is taken up with administrative work. These activities are not in the nature of risk management but are imposing on resources that have to be used for other things before taking risk decisions.”

Carpenter says banks could be more effective in vendor management if they first take a step back and recognize the business value of vendor management. “Officers see it as red tape, and the business value isn’t quite believed in or known by them,” he says. 

Instead, Carpenter urges banks to redefine their relationships with third parties. “If community banks don’t start thinking about third parties almost like they do their own people, they probably won’t challenge themselves to think about what the actual value of this relationship is and how might we measure that,” he says. 

Miller agrees that vendor management is a harbinger of new ways of doing business. “The world is much more focused on partnership,” he says. “Technology can play a role in supporting this process and making it better and more streamlined. That gives bankers a chance to get back to what they do best: build and sustain better relationships.”

---