Notes on the questions our clients face, written by the people who do the work.
The annual certification is a personal attestation. The two forms ask different things, and the evidence behind them must exist before anyone signs. This is where firms are most often caught short.
Read the noteMany firms hand the Safeguards Rule to their IT provider and consider it handled. Its hardest requirements are not technical: appointing a qualified individual, writing the risk assessment and reporting to the board.
Read the noteLender and servicer questionnaires now act as a second regulator for the firms that serve them. Answering from a maintained evidence file takes days rather than months.
Read the noteTwo weeks and a fixed fee, and you will be reading about your own firm rather than someone else's.