Article

Select and Supervise Your Plan’s Vendors Carefully!

 
A sizable fine from the U.S. Securities and Exchange Commission (“SEC”) is a sharp reminder of the danger of selecting retirement plan service providers based on their name recognition.

The SEC has issued a $35 million fine against Morgan Stanley Smith Barney LLC specifically for what was described as the company’s widespread failures over five years to secure the personally identifiable information, or PII, of around 15 million clients. No solid evidence exists that pinpoints the number of retirement plan accounts affected. However, it’s reasonable to expect that Morgan Stanley’s failure exposed many accounts to the risk of cyber security intrusions.

The news of Morgan Stanley’s violation should awaken all retirement plan committee members to the importance of fulfilling their duty to select service providers based on their competencies, not merely their brand name. Monitoring the providers ongoing is equally crucial, and the failure to do so can result in irreversible damage to the retirement plans they manage.