Why must supervisory committees confirm their credit union’s vendors are compliant?
“Because if they’re not, they're not the ones that will get spanked by examiners,” says attorney Frank Drake. “You’re the one that’ll get spanked.”
And in their role as “the conscience of the board,” it’s incumbent upon supervisory committees to review vendor contracts. This involves “asking questions that will make vendors uncomfortable,” says Drake, who addressed the CUNA Supervisory Committee and Internal Audit Conference.
Being entirely vendor compliant is no small task. Drake says credit union leadership should ask:
If you answered "no" to any of those questions, you are noncompliant, Drake says. He would know, because he trains regulators to look for those and similar offenses.
“They regulate through you what they cannot regulate directly,” Drake says.
Evaluating every vendor contract the credit union holds consumes time and money, acknowledges Drake, who insists that “nobody should sign any third-party contract without knowing eyes [attorneys] seeing it first."
He advises credit unions to prioritize their audit: “Make sure the degree of diligence matches the degree of risk.”
Credit unions should vet third-party vendors similarly to how they evaluate member business loan applications: requesting an unaudited annual income statement, checking with state authorities to ensure they’re licensed to do business in your area, and making onsite visits to “find out if they are who they claim to be,” Drake says.
Understand that whenever you contract with a vendor, you’re also liable for the actions of any subcontractors they enlist, he Drake.
Don’t sign a vendor contract longer than three years, Drake advises. This will cap your exposure.
Firing a vendor is difficult and likely costly given that standard contracts typically include buyout clauses and choice of venue provisions. These detail that any legal actions against the vendor take place in their home state and county.
Also, create an electronic library of vendor policies and procedures that you’ve requested, and stop using paper as much as possible.
“The existence of paper documents is an unnecessary risk,” Drake says.