Vendor Oversight Insights from the FINRA Small Firm Conference
At the recent FINRA Small Firm Conference, panelists explored how effective vendor management supports compliance, cybersecurity, and operational resilience across financial services. The discussion surfaced several best practices firms may want to consider as part of their broader governance and risk frameworks.
| Focus area | Practice to consider |
|---|---|
|
Vendor oversight |
Take a lifecycle approach that includes selection, due diligence, onboarding, monitoring, and offboarding. |
|
Cybersecurity and Regulation S-P |
Review whether vendors have written incident-response procedures and clear reporting protocols for data incidents. |
|
AI use |
Keep human oversight in the loop and understand how vendors use and secure data when AI is part of their offering. |
|
Documentation |
Maintain clear records of vendor reviews and decisions to show a consistent process. |
|
Communication records |
Ensure vendors can meet books and records and supervision obligations, especially for communications data. |
|
Resilience and continuity |
Test business continuity and vendor backup processes periodically to stay prepared for disruptions. |
What stood out to me during the session was how much vendor risk overlaps with regulatory and operational risk. The conversation wasn’t about adding more checklists. It was about building stronger relationships and clearer visibility into the vendors firms rely on every day.
For anyone managing compliance or technology partnerships, these insights were a timely reminder that good vendor oversight is really about resilience, transparency, and trust.
Share this post!
- Vendor Oversight Insights from the FINRA Small Firm Conference - November 20, 2025
- When Policies Fail, People Pay — Personal Liability Is Back - November 13, 2025
- Off-Channel Still Isn’t Over: When Archiving Gaps Create Compliance Headaches - November 6, 2025
Smarsh Blog
Our internal subject matter experts and our network of external industry experts are featured with insights into the technology and industry trends that affect your electronic communications compliance initiatives. Sign up to benefit from their deep understanding, tips and best practices regarding how your company can manage compliance risk while unlocking the business value of your communications data.
Ready to enable compliant productivity?
Join the 6,500+ customers using Smarsh to drive their business forward.
More Resources
Subscribe to the Smarsh Blog Digest
Subscribe to receive a monthly digest of articles exploring regulatory updates, news, trends and best practices in electronic communications capture and archiving.
Smarsh handles information you submit to Smarsh in accordance with its Privacy Policy. By clicking "submit", you consent to Smarsh processing your information and storing it in accordance with the Privacy Policy and agree to receive communications from Smarsh and its third-party partners regarding products and services that may be of interest to you. You may withdraw your consent at any time by emailing [email protected].
FOLLOW US