IT Due Diligence: A Financial Services Guide to Vetting Your IT Provider

TL;DR: Regulated firms stay accountable for the IT they outsource, so vetting your provider matters. Use these questions and red flags to test your current setup, then ask Datek for a second opinion with no lock-in.

When did you last ask your IT provider to prove how well it looks after your firm? An audit or a renewal often prompts the question, and regulators take a close interest in outsourced technology too.

IT due diligence gives financial services firms a clear way to find the answer, and it strengthens your financial services cyber security along the way.

This guide covers the questions to ask and the warning signs to spot, plus how to get a second opinion without disrupting your current setup.

Why IT Due Diligence Matters More for Regulated Financial Firms

Financial services firms are accountable for the risks that sit inside outsourced technology. Handing a system to a supplier doesn’t hand over the responsibility for it.

Regulators expect boards to understand the third parties their important services depend on, so your provider’s performance becomes part of your own compliance position.

Financial services cyber security raises the stakes further. Client data and confidential records make these firms an attractive target, and a weak control at the provider can become a weak control in your business.

The FCA’s Operational Resilience: Insights and Observations One Year On found that firms still have more work to do in finding and fixing third-party vulnerabilities. It also observed that mapping has largely focused on technology, and it asked firms to include the wider dependencies that sit with external providers. Careful IT due diligence is how you close that gap.

Due diligence should leave your board able to answer two practical questions: what does the provider own, and what evidence shows it’s doing the job?

Key Questions to Ask About Monitoring, Backups and Incident Response

These questions are a good place to start, and the right IT provider will happily back up every answer with evidence.

• Which systems are monitored around the clock, and who responds when an alert fires overnight?
• How are significant alerts investigated and followed through to completion?
• When was the last successful backup restore test, and can you see the results?
• Does at least one backup copy sit somewhere an attacker on your network couldn’t reach?
• Is there a written incident response plan, and when was it last rehearsed?
• Who contacts your firm first when something goes wrong, and how quickly do they do it?
• Can the provider supply the evidence your firm needs when an auditor asks how a system is managed?

Datek restores and verifies client backups every quarter, because a notification that a backup completed only confirms that a job ran.

Red Flags to Watch for During Your Review

Some warning signs appear quickly once you start asking.

• Unclear escalation chains mean nobody can say who owns a major incident or how quickly it moves up.
• Vague contracts leave service levels and exit terms open to interpretation.
• Limited access to documentation means the people accountable for your systems can’t see how they’re configured.
• Long minimum terms with exit penalties make it difficult to act on what you find.
• Reports that only list ticket volumes say little about the condition of your environment.

Even one of these items deserves a closer look, and several together suggest the relationship needs a formal review. Datek works on rolling monthly terms, and clients own their documentation and administrative access throughout the relationship.

How to Benchmark Your Current Provider Against Best Practice

Benchmarking works best as a short, repeatable exercise. Mark each area below as evidenced or unevidenced, then ask for proof wherever the answer is unclear.

• Your provider completed an onboarding audit that recorded the condition of your environment and the risks found.
• Documentation is current, and your firm can retrieve it whenever it needs to.
• Restore tests take place on a schedule, and the results are recorded.
• Known risks sit on a visible register with owners and target dates.
• Management receives regular service reviews that cover progress on earlier actions.
• Your firm has a clear picture of what a handover would involve if you ever changed providers.

Anything you can’t evidence is a conversation worth having now, before an auditor or regulator raises it for you.

Getting a Second Opinion Without Disrupting Your Current Setup

You can get a second opinion without moving anything or having an awkward chat with your current provider. An independent review looks at your environment and recovery arrangements alongside whatever you have in place, then reports back with findings you can use as you choose.

A useful second opinion covers monitoring coverage and backup testing, then summarises what’s working and what needs attention.

Datek offers exactly that, with no obligation attached. One professional services firm discovered why independent checks matter when an audit found servers left unpatched for hundreds of days and nine months of failed cloud backups, even though day-to-day support had looked fine.

Datek is comfortable with that level of scrutiny because its standards already stand up to it, including regular audits and tested backups. Monthly rolling terms mean the offer carries no lock-in, so you can act on the findings at your own pace.

Give Your IT Provider the Scrutiny It Deserves

Book a no-obligation second opinion with Datek today.

Your current setup stays exactly as it is while we review it. Get in touch and find out where your environment really stands.

FAQs

1. What is IT due diligence for a financial services firm?
   IT due diligence is a structured review of how well your IT provider manages the systems and data your firm depends on. It covers monitoring, backups, incident response, documentation and contract terms. It also gives you evidence you can show to auditors and regulators.
2. How often should we carry out IT due diligence on our provider?
   Most firms benefit from a formal review at least once a year, and again before a renewal or after a significant incident. Regular service meetings between those reviews help keep the picture current.
3. What should financial services cyber security look like from an IT provider?
   It should include continuous monitoring and tested backups, plus a rehearsed incident response plan with clear escalation routes. Your provider should be able to show evidence of each one on request.
4. Can we get a second opinion on our IT provider without switching?
   Yes, an independent review can run alongside your existing arrangement, with no migration and no change to your contract. Datek offers a no-obligation second opinion for financial services firms.
5. What contract terms should we look for when vetting an IT provider?
   Look for clear service levels and defined exit terms, along with the right to access your own documentation at any time. Rolling monthly terms, like Datek’s, also leave the choice to move firmly with you.