FFIEC IT Examination Handbook DAM-IV.P.2: IV.P.2 Due Diligence and Third-Party Selection (Development, Acquisition, and Maintenance)

Management conducts due diligence before selecting a third party, in proportion to the risk and complexity of the activity, assessing the third party's ability to perform, adhere to the entity's policies and comply with law, and where a third party cannot supply the desired information because it is new, refuses site visits or cannot share, documents the limitation, understands its risk, considers alternatives and evaluates supplemental information against its own performance criteria.