Risk Management Manual of Examination Policies - FDIC

REPORT OF EXAMINATION INSTRUCTIONS Section 16.1
PURPOSE
INFORMATION TECHNOLOGY ASSESSMENT (ITA)
With the release of the IT-MERIT and IT General Work Program, all financial institutions are classified according
to their technology risk profile (I, II, III, or IV). Furthermore, all institutions receive, at a minimum, an IT
composite rating. For embedded IT examinations, the ITA page should convey assigned IT composite and/or
component rating(s), as well as all significant IT examination conclusions, recommendations, and management
responses.
WHEN TO INCLUDE
In general, IT findings are embedded within the risk management ROE, using the ITA page, unless a separate cover
IT ROE is required. A separate cover Report is required for:
• Institutions with a composite rating of 3, 4, or 5 at the current IT examination;
• Independent data centers or institutions that perform core data processing services for other FDIC-insured
financial institutions (including affiliated institutions); or
• Type IV IT examinations.
ASSIGNING AND DISCLOSING RATINGS
The following table summarizes outstanding guidance regarding assigning and disclosing ratings under the Uniform
Rating System for Information Technology (URSIT).
Assign and Disclose –
Composite URSIT Rating Only
Full URSIT Rating
PAGE STRUCTURE AND ORDER
Numerical Ratings
In These Situations -
• Type I examinations
• Type II examinations if all component ratings warrant a 1 or 2 rating
• Type II examinations if any component rating or the composite rating
warrants a 3, 4, or 5 (Note that a composite rating of 3, 4, or 5 would
require a separate cover IT Report.)
• Type III examinations
• Type IV examinations (requires a separate cover IT Report)
The ITA page, as formatted by Genesys, includes a grid at the top of the first page to display the component and
composite ratings for the current and two prior IT examinations. Ratings for the current examination should be
assigned and disclosed based on the guidance summarized in the above table. Prior examination ratings shown
should reflect ratings disclosed at those examinations. For example, even if the current examination only requires a
DSC Risk Management Manual of Examination Policies 16.1-17 Report of Examination Instructions (12-04)
Federal Deposit Insurance Corporation