RegAlertGuidance · FDIC · 29 Aug 2024 · FIL-60-2024
Updated FFIEC IT Examination Handbook Development, Acquisition, and Maintenance Booklet
The Federal Financial Institutions Examination Council issued the updated Development, Acquisition, and Maintenance booklet to replace its April 2004 predecessor and expand examination focus to include ongoing maintenance of IT systems. The guidance establishes enterprise-wide principles and updated procedures that help regulators assess governance, planning, acquisition, and change control without imposing new compliance mandates on supervised institutions. By clarifying evaluation standards for risk management and service delivery, the document ensures consistent oversight of IT lifecycle functions across financial entities and their third-party providers.
Examination Procedures and Manual Updates
August 29, 2024
Share on Facebook
Share on X
Follow the FDIC on LinkedIn
Share through email
Summary:
The Federal Financial Institutions Examination Council (FFIEC) issued the Development, Acquisition, and Maintenance (DA&M) booklet , which is part of the FFIEC Information Technology Examination Handbook . The booklet replaces the Development and Acquisition booklet issued in April 2004. Statement of Applicability:
FDIC-Supervised Institutions and their service providers.
Highlights:
The DA&M booklet outlines principles and practices for managing development, acquisition, and maintenance. This booklet describes principles and practices that examiners review to assess an entity’s DA&M functions. The booklet also helps examiners determine whether management adequately addresses risks related to DA&M and delivery of critical financial products and services. This booklet focuses on enterprise-wide, process-oriented approaches that relate to the development of information technology (IT) systems and components within the overall enterprise and business structure, acquisition of IT systems and components, and maintenance of IT systems and components to provide ongoing value for customers. The booklet also contains updated procedures to help examiners evaluate the adequacy of an entity’s programs related to DA&M. The booklet focuses on assessing an entity’s governance of common DA&M-related risks, enterprise-wide IT development planning and design, acquisition of IT systems and components, and maintenance and change control processes. The change in the title of the booklet from Development and Acquisition to Development, Acquisition, and Maintenance reflects the expanded role IT plays in supporting enterprise and business operations and meeting internal and external customer expectations. The industry principles and frameworks included provide examiners with a durable means to assess development, acquisition, and maintenance. The booklet issuance does not impose new requirements on examined entities.
FIL-60-2024
Attachment(s)
FFIEC Information Technology Examination Handbook
Related Topics
Digital Assets
Examination Processes and Procedures
Fintech
Information Technology
Third-Party Relationships
Contact(s)
Division of Risk Management Supervision
Note from RegAlert. AI assistants can read this document in full, and search 70,000+ more, through the RegAlert MCP connector (https://mcp.regalert.today/mcp). Free with an account. How to connect ChatGPT, Claude or Cursor.
Lineage: No known changes
RegAlert holds no document that amends or replaces this one. This is not a check that it is in force: confirm with the regulator.
The links and the sentences they come from (1)
- Supersedes
- Circular of 2004Not in RegAlert
“The booklet replaces the Development and Acquisition booklet issued in April 2004.”
Similar documents from other regulators
FRBSR 24-6: FFIEC Information Technology Examination Handbook – Development, Acquisition, and MaintenanceUS Federal · 2024-08-29
HKMAExaminations on Controls over Information Technology (IT) Problem and System Change ManagementHong Kong · 2008-01-07
More like this from FDIC
FDIC published 2 documents in the last 30 days. We email you each new one the day it's published.
Source: Federal Deposit Insurance Corporation — original document · Summary generated with machine assistance and reviewed before publication; the authoritative text is the regulator's original document. How RegAlert works
In RegAlert: added · updated