Loan Document Scanning With Offshore Vendor and Regulatory Audit
Lakeshore Financial Group is scanning 600,000 loan documents per year to support mortgage servicing. Regulations include SOX, GLBA, and a seven-year retention requirement; documents must be retrievable for audits within two business days. The bank uses an offshore scanning vendor that receives paper, images it at 300 dpi, and returns PDFs over a VPN. Internal audit found that 3 of 25 sampled batches lacked a complete chain-of-custody log and that deleted images remained in a staging area for 45 days. The vendor's SOC 2 report is 14 months old. The bank also wants to use OCR for loan-number indexing, but error rates on handwritten borrower names are 18 percent. The compliance officer must approve the scanning program, define security controls, and set retention and destruction rules before the next regulatory examination.
1. What security controls would you require for the offshore scanning vendor and the return of images over VPN?
Read the worked answer
Require encryption in transit with TLS 1.2 or higher and at rest with AES-256. The vendor must segment the bank's data from other clients, restrict access by role, and use MFA for all administrative accounts. Before paper leaves the bank, log each box with a unique ID and seal number; the vendor must scan the seal intact and reconcile box contents to the image count. Return images over a site-to-site VPN or an encrypted transfer service, not email. The vendor must not store images on endpoints or removable media; if staging is necessary, encrypt it and purge within 24 hours. Require immutable audit logs of every access, download, and deletion, retained for seven years. Prohibit offshore access to decryption keys; the bank should hold keys. Add a right-to-audit clause and quarterly vulnerability scans. These controls address the audit findings on chain of custody and lingering deleted images.
2. The vendor's SOC 2 report is 14 months old. What vendor oversight would you require before approval?
Read the worked answer
Do not accept a 14-month-old SOC 2 Type II as current evidence. Request the most recent report, and confirm the audit period covers at least six recent months. Review the scope: it must include the scanning facility, the transfer service, and the staging environment. Read the exceptions and management responses, not just the opinion. Require a bridge letter for the gap period, plus the vendor's remediation evidence for any exceptions. If the report is still stale, commission a targeted onsite audit or a penetration test before sending paper. Add contractual requirements for annual SOC 2 Type II, notification of security incidents within 24 hours, and the bank's right to audit with 30 days' notice. Because the work is offshore, confirm data residency and subservice-organization controls. Approval should be conditional on closure of the chain-of-custody and deletion findings, with a 90-day recheck.
3. Define the retention and destruction rules, including how to handle the 45-day staging-area deletion gap and chain-of-custody logs.
Read the worked answer
Set retention at seven years after loan payoff or account closure, whichever is later, with a legal-hold override. Classify documents by record series, such as note, deed, disclosure, and correspondence, because not every page shares the same retention. Destruction must be documented with a certificate listing box IDs, image IDs, method, date, and approver; for paper, use cross-cut shredding or pulping, and for images, cryptographic erasure or verified deletion. The 45-day staging gap is a control failure: require purge within 24 hours of confirmed ingest, automated deletion jobs with exception alerts, and a monthly reconciliation that samples staging to prove no images remain. Chain-of-custody logs must be created at pickup, updated at every transfer, and retained for the full retention period. Do not let the vendor destroy paper until the bank has verified image quality and completeness. Audit the destruction process annually.