Skip to main content
U.S. flag
An official website of the United States government
Dot gov
The .gov means it’s official. 
Federal government websites often end in .gov or .mil. Before sharing sensitive information, make sure you’re on a federal government site.
Https
The site is secure. 
The https:// ensures that you are connecting to the official website and that any information you provide is encrypted and transmitted securely.
INACTIVE
This page is no longer active. Its content has expired or been rescinded by the FDIC.
Financial Institution Letter

FFIEC Information Technology Examination Handbook

TO: CHIEF EXECUTIVE OFFICER (also of interest to Chief Information Officer)
SUBJECT: New Guidance for Examiners, Financial Institutions and Technology Service Providers on Development and Acquisition of Information Systems
Summary: The Federal Financial Institutions Examination Council (FFIEC) has issued a booklet with guidance on evaluating development and acquisition activities. The booklet is the eighth in a series of updates, which will eventually replace the 1996 FFIEC Information Systems Examination Handbook and comprise the new FFIEC Information Technology (IT) Examination Handbook.

On May 27, 2004, the Federal Financial Institutions Examination Council (FFIEC) issued revised guidance for examiners, financial institutions and technology service providers on the development and acquisition of information technology. This guidance – the Development and Acquisition Booklet – is the eighth in a series of updates to the 1996 FFIEC Information Systems Examination Handbook .

The Development and Acquisition Booklet provides guidance on development, acquisition and maintenance projects, project risks, and project management techniques. The booklet emphasizes the use of standardized policies, detailed plans, and well-structured project management techniques when directing project activities and controlling project risks. Effective development and acquisition should result in sound information systems that provide specific functionality, consistent reliability, and strong security.

The FFIEC is issuing updates in separate booklets that will ultimately replace all chapters of the 1996 Handbook and comprise the new FFIEC Information Technology (IT) Examination Handbook . Future booklets will address wholesale payment systems, outsourcing, IT management, and computer operations. These updates will address significant changes in technology since 1996 and incorporate a risk-based examination approach.

The FFIEC agencies are distributing this booklet electronically to financial institutions and technology service providers via the Internet through the FFIEC's InfoBase application. The InfoBase includes each booklet in Adobe Acrobat PDF file format, as well as an online version with links to various resource materials and an orientation to the handbook update process.

The electronic version of the Development and Acquisition Booklet is available at http://www.fdic.gov/regulations/information/information/FFIEC.html . For more information about the development and acquisition of technology systems, please contact your FDIC Division of Supervision and Consumer Protection Regional Office.

For your reference, FDIC Financial Institution Letters may be accessed from the FDIC's Web site at http://www.fdic.gov/news/financial-institution-letters/2004/index.html .

Michael J. Zamorski
Director
Division of Supervision and Consumer Protection

# # #

Distribution: FDIC-Supervised Banks (Commercial and Savings)

NOTE: Paper copies of FDIC financial institution letters may be obtained through the FDIC's Public Information Center, 801 17th Street, NW, Room 100, Washington, DC 20434 (1-877-275-3342 or (703) 562-2200).



FIL-64-2004

Last Updated: June 8, 2004