Tyler Henry discusses third-party auditor breach notification with American Banker

Tyler Henry spoke with American Banker about what data breaches at outside auditors mean for the financial institutions that rely on them.

Tyler explained that when an auditor is breached, the duty to notify affected customers stays with the bank. The challenge, he noted, is that the bank can only act once the auditor tells it about the incident, which in the case of audit firm Mercadien happened six to nine months after the breach was discovered.

He pointed to contracting practices as part of the problem. Audit and advisory firms tend to use short, standard engagement letters that receive less legal and security review than a typical IT vendor contract, which can leave out requirements for prompt breach notice.

Read the full article in American Banker.