Updated FFIEC IT Examination Handbook – Development, Acquisition, and Maintenance Booklet

Summary:

The Federal Financial Institutions Examination Council (FFIEC) issued the Development, Acquisition, and Maintenance (DA&M) booklet, which is part of the FFIEC Information Technology Examination Handbook. The booklet replaces the Development and Acquisition booklet issued in April 2004.

Statement of Applicability: FDIC-Supervised Institutions and their service providers. 

Highlights:

• The DA&M booklet outlines principles and practices for managing development, acquisition, and maintenance. This booklet describes principles and practices that examiners review to assess an entity’s DA&M functions. The booklet also helps examiners determine whether management adequately addresses risks related to DA&M and delivery of critical financial products and services.
• This booklet focuses on enterprise-wide, process-oriented approaches that relate to the development of information technology (IT) systems and components within the overall enterprise and business structure, acquisition of IT systems and components, and maintenance of IT systems and components to provide ongoing value for customers.
• The booklet also contains updated procedures to help examiners evaluate the adequacy of an entity’s programs related to DA&M. The booklet focuses on assessing an entity’s governance of common DA&M-related risks, enterprise-wide IT development planning and design, acquisition of IT systems and components, and maintenance and change control processes.
• The change in the title of the booklet from Development and Acquisition to Development, Acquisition, and Maintenance reflects the expanded role IT plays in supporting enterprise and business operations and meeting internal and external customer expectations.
• The industry principles and frameworks included provide examiners with a durable means to assess development, acquisition, and maintenance. The booklet issuance does not impose new requirements on examined entities.