Regulatory Alerts2024-08-29 | FIL-60-2024Updated FFIEC IT Examination Handbook Development, Acquisition, and Maintenance Booklet
The Federal Financial Institutions Examination Council issued the updated Development, Acquisition, and Maintenance booklet to replace its April 2004 predecessor and expand examination focus to include ongoing maintenance of IT systems. The guidance establishes enterprise-wide principles and updated procedures that help regulators assess governance, planning, acquisition, and change control without imposing new compliance mandates on supervised institutions. By clarifying evaluation standards for risk management and service delivery, the document ensures consistent oversight of IT lifecycle functions across financial entities and their third-party providers.
Examination Procedures and Manual Updates
August 29, 2024
Share on Facebook
Share on X
Follow the FDIC on LinkedIn
Share through email
Summary: The Federal Financial Institutions Examination Council (FFIEC) issued the Development, Acquisition, and Maintenance (DA&M) booklet , which is part of the FFIEC Information Technology Examination Handbook . The booklet replaces the Development and Acquisition booklet issued in April 2004. Statement of Applicability:
FDIC-Supervised Institutions and their service providers. Highlights: The DA&M booklet outlines principles and practices for managing development, acquisition, and maintenance. This booklet describes principles and practices that examiners review to assess an entity’s DA&M functions. The booklet also helps examiners determine whether management adequately addresses risks related to DA&M and delivery of critical financial products and services. This booklet focuses on enterprise-wide, process-oriented approaches that relate to the development of information technology (IT) systems and components within the overall enterprise and business structure, acquisition of IT systems and components, and maintenance of IT systems and components to provide ongoing value for customers. The booklet also contains updated procedures to help examiners evaluate the adequacy of an entity’s programs related to DA&M. The booklet focuses on assessing an entity’s governance of common DA&M-related risks, enterprise-wide IT development planning and design, acquisition of IT systems and components, and maintenance and change control processes. The change in the title of the booklet from Development and Acquisition to Development, Acquisition, and Maintenance reflects the expanded role IT plays in supporting enterprise and business operations and meeting internal and external customer expectations. The industry principles and frameworks included provide examiners with a durable means to assess development, acquisition, and maintenance. The booklet issuance does not impose new requirements on examined entities.
FIL-60-2024
Attachment(s)
FFIEC Information Technology Examination Handbook
Related Topics
Digital Assets
Examination Processes and Procedures
Fintech
Information Technology
Third-Party Relationships
Contact(s)
Division of Risk Management Supervision