Risk Management Manual of Examination Policies - FDIC

REPORT OF EXAMINATION INSTRUCTIONS Section 16.1
composite rating, if a prior examination disclosed a full URSIT rating, the full rating should be shown for that prior
examination.
Below the grid, the examiner should include the appropriate composite rating paragraph, as taken from the Uniform
Rating System for Information Technology.
Required Comments
Scope of Examination – Include a brief statement outlining the IT examination scope/areas reviewed. This should
include the scope of review covering the bank’s efforts to comply with Interagency Guidelines Establishing
Standards for Safeguarding Customer Information (Appendix B to Part 364 of the FDIC Rules and Regulations. It is
not necessary to include a detailed description of the bank’s IT functions.
Supporting Comments – Comments should be prepared on an “exception only” basis as much as possible; however,
they should support the ratings assigned and recommendations presented, and document management’s responses to
recommendations. Address issues in order of priority and risk. Significant issues should be brought forward to the
ECC page. Use descriptive subheadings, bulleted or numbered lists, and other such devices as needed to promote
readability. For example, component ratings paragraphs would be appropriate when full URSIT ratings are
assigned.
Management Discussions – Identify bank officials with whom IT operations and examination findings were
discussed.
Report of Examination Instructions (12-04) 16.1-18 DSC Risk Management Manual of Examination Policies
Federal Deposit Insurance Corporation