Answer:
On December 12, 2007 the FFIEC issuance interagency guidance on the subject. The press release can be accessed here, and the 10-page interagency guidance can be accessed here.
Archive of Risk Management Questions
First published on BankersOnline.com 11/12/08