IT Examiner School - Oct 2025

Classification Number: 6600 Date: July 29, 2025 Issuing Office: IT Supervision Section Contact: Brian Simmons (678) 916-2343 ☒ Notice ☐ Memorandum

Division of Risk Management Supervision MEMORANDUM SYSTEM

Transmittal No. 2025-027-RMS

MEMORANDUM TO:

Regional Directors

FROM:

Ryan Billingsley Acting Director

SUBJECT:

Information Technology Examination Procedures

1. Purpose: To provide guidance to examiners in planning and conducting risk-focused Information Technology (IT) examinations at banks of all complexity levels. 2. Background: Examiners should use a risk-focused approach to IT supervision by assessing the adequacy of a bank’s Information Security Program, consistent with Part 364, Appendix B, using the Information Technology Risk Examination (InTREx) procedures. However, through December 31, 2025, the IT Examination Procedures described below will replace the InTREx procedures. 3. Summary of Changes: This Notice specifies revised scope IT examination procedures. Examiners continue to have discretion to expand an examination scope or procedures if significant problems are identified where these revised procedures would be insufficient to assess the overall adequacy of the bank’s Information Security Program. 4. Action: RMS personnel will use the revised processes and procedures in planning and conducting IT examinations at all institutions. IT Examination Procedures: Examiners should assess the adequacy of a bank’s Information Security Program using the following procedures: a) Forward the Information Technology Profile (ITP) to the IT Officer 90 days before the examination. b) A supervisor or designee should validate the institution’s ITP responses and determine examination resources 75 days before the examination. c) During the examination, complete the following five examination procedures: i. Assessment of IT risk management practices and the actions taken as a result of the risk assessment. The components of the assessment should include the following:

1