Centralized & Standardized Approach Third Party Risk Management

Why Outsource Services? Focus on Your Core Competencies Reduce Labor Costs Increased Efficiencies Economies of scale for Vendor – Better pricing for Client Access to Best Tools & Resources However… You Cannot Outsource Liability So You Must Have a Robust Oversight Program

Risks of Outsourcing Regulatory Compliance Information Security Reputational Risks Business Continuity Operational Risks Privacy Quality Code of Conduct/Ethics Environmental Geo-Political Health & Safety Labor Standards Supply Chain Risks

Typical TPRM Reporting Structures Finance Commodity Type Legal Contract Focus Risk Management TPRM Business Line Typical TPRM Reporting Structures  

Cross-Functional TPRM Program Third Party Risk Management Program Program Support/ Tools Compliance Sourcing & Procurement Business Units Enterprise & Operational Risk Legal Internal Audit Information Technology Risk Office Information Security Third Parties CENTRALIZATION

Regulatory Recommended 4 Elements of TPRM Outsourcing Risk Analysis Pre-Engagement Due Diligence Contract Negotiation & Restructuring Ongoing Monitoring & Performance STANDARDIZATION

Oversight Lifecycle Registration Outsourcing Risk Analysis Exit Strategy Pre-Engagement Due Diligence Request for Proposal Contracting Ongoing Monitoring Audit & Inspection Issue Management Termination/Renewal

Aligning Due Diligence Tiering Risk & Aligning Due Diligence Tier 1 Highest Risk Onsite Audits Tier 2 Desk Audit Tier 3 Lowest Risk Performance Scoring Financial Reputation OFAC Exclusionary STANDARDIZATION

Audit Process Tiering Recurring Schedule Auditor Independence

STANDARDIZATION Audit Scope General Information Organization structure Third-party relationships Discuss site logistics and touring; operational facility, data center, off-site record retention, etc. Offshore State-Side Vertical Audit Follow-up Audit Issues/Remediation Pending Action Items Service to Ocwen Services provided to Ocwen Process Flow of Service Customer Contact Data/Non-Public Information (NPI) Movement Ocwen Network/Application Access Service to Ocwen (continued) Business Rules (Adequacy and completeness to ensure Ocwen, Investor, Regulatory compliance) SLA compliance/Reporting Score-carding (adequate performance metrics) Review Due Diligence Package (DDP) for any questions/concerns Quality Control & Assurance Structure Program Detail Reviews/Testing Conducted Documented/Communicated Results and Reporting Compliance (Local, Federal Regulatory, State, Ocwen/Investor) Applicable Laws, Regulations, Requirements Discuss program methodology Business Rules (Adequacy and completeness to ensure Ocwen, Investor, Regulatory compliance) Assurance for proportionate service/care across geographical, demographic areas Complaints (sources, escalation process, reporting.) Compliance Training BCP/Disaster Recovery Review Plans Review Results Relevant Failures Remediated, etc… STANDARDIZATION

STANDARDIZATION Audit Scope Cont’d Vendor Management Identify high-risk third-party vendors Identification Screening Monitoring Supervision Observation & Interview with Processing Team/Representative of Core Ocwen Service Scheduled & Deviation Processing Control Points Status Reporting Incident Reports Information Security Policy/Procedures/Governance Network Infrastructure / Architecture Data Flow Encryption Access/ Data Security/Audit & Recovery Back-up Process Incident Reporting/ Response Process Cloud Computing Remote Access Mobile Devices Physical Security Coordinator Discuss Physical Security Program Observe Site Physical Security Human Resources/Recruiting Internal & Contractors Hiring Practices & Requirements Communication of Job Duties Structure of Monitoring/Supervision Logical and physical security access authorizations Review hiring, termination and requirements documents Facility Tour Physical security - Internal & access security Observe Processing Areas Data/Server Security, etc… Accounts Receivable – Invoicing to Ocwen Fees Schedule and SLA Reconciliation Process Billing Accuracy Assurance STANDARDIZATION

STANDARDIZATION Controls Reviewed Vendor Management Physical & Logical Security Controls Human Resources Management Network Management Training/Certifications Encryption Business Continuity Planning (BCP) Remote Access Disaster Recovery (DR) Mobile Devices Regulatory Compliance Change Management Incident Response Cloud Computing Management Reporting Password Management Quality Management System STANDARDIZATION

Why Centralize TPRM? Ensure all vendors, corporatewide, are vetted and managed to same standards Ensure end-to-end process flow without gaps Ensure all vendor data is secured in single database and retained per corporate policy Ensure all vendor audit and performance issues are timely reported and managed Single source of reporting Most efficient use of resources Eliminate duplication of effort/review

Trends Standardization 4th Party Oversight Issues Shared Assessment - Standard Information Gathering (SIG) Mortgage Bankers Association (MBA) Default Firm Project Contract Templates Tools Standardization Vendor Oversight (Process Unity, Metric Stream, ServiceNow, etc.) Security Scoring (Bitsight, Security Scorecard, etc.) Financial Reviews (Rapid Ratings, IDC, Experian, etc. ) Reputation Monitoring (Lexis Nexis (World Compliance), Google, etc.) GRC (Reg/Standard Libraries, Issue Management, etc.) Reliance on SOC reports Social Media Focus on Third Party program strength 4th Party Oversight Cloud Security Incident Management Cyber Security Issues

Questions. D. Michelle Murphy, Esq. https://www. linkedin