FFIEC IT Examination Handbook TSP-03: Audit and Internal Controls (Supervision of Technology Service Providers)

TSPs maintain well-planned, risk-based internal and external audit programs as a critical defence against fraud and a source of information to the board on the effectiveness of internal controls, judged against the Audit and Management booklets; the agencies issue a uniform Report of Examination with a URSIT rating to the TSP's board and distribute the open section to serviced institutions automatically for composite ratings of 4 or 5 and on request otherwise, and the TSP provides a customer list of serviced institutions.