FFIEC IT Examination Handbook DAM-VI.E.5: VI.E.5 Escrowed Source Code Agreements and Documentation (Development, Acquisition, and Maintenance)

Where vendors withhold proprietary source code, an independent escrow agent holds the code and documentation, management verifies annually that a current version is in escrow, the escrowed documentation includes narratives, flowcharts, source listings, file and record layouts, field descriptions and calculation routines, the contract requires the vendor to disclose any pledge of the software as loan collateral, the risks of a foreign-based escrow are considered, and the escrow agreement specifies minimum code documentation, maintenance procedures, release conditions and the further provisions the booklet lists.