Overall readiness
Established
The maturity model’s reference band for a community bank of this asset size is 56. First Community Bank is +9 against the band. The band is SmarterFI’s own model, not a survey of institutions.
Where these numbers come from
The reference band is SmarterFI’s own maturity model, not a survey of institutions: it is the level the model expects of a community bank of this asset size, and no bank’s answers are in it.
The deployment threshold of 60 is a fixed rule in the same model. Neither figure is drawn from this institution’s answers, and neither is a survey result.
Captured from the bank10 of 34 criteria
Observed by the scan3 of 34 criteria
Recorded in interview21 of 34 criteria
The five capture steps collect the institution, the core, the domains, the integration points and the environment. They do not ask about model governance, the automation footprint or organisational readiness — so those criteria are the assessor’s record of an interview, attributed and dated, rather than something the bank typed in.
By dimension
The mark on each bar is the deployment threshold of 60. Every dimension's criteria total 100 points.1 below the thresholdCore & System LandscapeEstablished73
Strongest: core banking system identified and on a vendor-supported release. Weakest: integration architecture aligned to the vendor’s roadmap — initial. Reference band 63 — +10 against it.
4 criteria, totalling 73 of 100 points
| Criterion | Level | Points | Answered by | Evidence |
|---|---|---|---|---|
| Core banking system identified and on a vendor-supported release | Managed | 30 / 30 | CapturedStep 2 — Core Banking Systems | Jack Henry SilverLake 2024.2, in-house on a bank-managed hardened VM. |
| Ancillary system inventory complete | Managed | 20 / 20 | CapturedStep 2 — Core Banking Systems | Four ancillary systems recorded: Banno Digital, Yellow Hammer BSA, Synergy ECM, PassPort EFT. |
| Integration architecture aligned to the vendor’s roadmap | Initial | 10 / 30 | Recorded in interviewInterview — IT Director, 5 Aug 2026 | jXchange is on SOAP with no OAuth 2.0 migration planned. Jack Henry retires the current authentication between 2026 and 2028; the bank has no dated plan. |
| Environment and hosting documented | Defined | 13 / 20 | CapturedStep 5 — Environment & Security | Region, identity provider, retention and encryption recorded; disaster-recovery runbook not attached. |
Data Quality & AccessibilityEstablished66
Strongest: core master files complete and extractable. Weakest: warehouse lineage documented — initial. Reference band 56 — +10 against it.
4 criteria, totalling 66 of 100 points
| Criterion | Level | Points | Answered by | Evidence |
|---|---|---|---|---|
| Core master files complete and extractable | Managed | 30 / 30 | Observed by the scanRead-only scan — FCBPROD, 5 Aug 2026 | 4 core schemas enumerated across 225 tables, every one reconciling with the documented volume. |
| Warehouse lineage documented | Initial | 10 / 30 | Recorded in interviewInterview — IT Director, 5 Aug 2026 | The warehouse has no lineage catalogue. Transformations live in scheduled jobs and are not documented outside them. |
| Record volumes reconcile between source and warehouse | Defined | 13 / 20 | Observed by the scanRead-only scan — variance report, 5 Aug 2026 | 6 of 8 schemas reconcile inside tolerance and 1 belongs to a domain the bank excluded. EDW.CARD_ACTIVITY does not reconcile, and the gap is not explained. |
| Data dictionary maintained for in-scope domains | Defined | 13 / 20 | CapturedStep 3 — Data Domains | Every in-scope domain has a system of record and a documented volume; field-level definitions exist for the core, not the warehouse. |
Integration & Architecture MaturityDeveloping64
Strongest: real-time inquiry capability available. Weakest: event-driven or streaming capability — not started. Reference band 54 — +10 against it.
5 criteria, totalling 64 of 100 points
| Criterion | Level | Points | Answered by | Evidence |
|---|---|---|---|---|
| Real-time inquiry capability available | Managed | 28 / 28 | CapturedStep 4 — Integration Points | jXchange is enabled and serving real-time inquiry. |
| Batch extract scheduled and monitored | Managed | 18 / 18 | CapturedStep 4 — Integration Points | Core nightly extract runs after end-of-day over SFTP, with alerting on failure. |
| Event-driven or streaming capability | Not started | 0 / 18 | Recorded in interviewInterview — IT Director, 5 Aug 2026 | No message bus, no change-data-capture, no event stream. Everything is batch or synchronous request. |
| API authentication modernised to OAuth 2.0 | Initial | 6 / 18 | Recorded in interviewInterview — IT Director, 5 Aug 2026 | Salesforce FSC would use OAuth 2.0 when enabled. Everything currently in production authenticates on shared secrets. |
| Integration register complete with direction and frequency | Defined | 12 / 18 | CapturedStep 4 — Integration Points | Five integration points documented with type, direction and frequency; one of the five is not enabled. |
Security & ControlsAdvanced77
Strongest: identity federation with multi-factor authentication enforced. Weakest: data classification applied per domain — initial. Reference band 64 — +13 against it.
5 criteria, totalling 77 of 100 points
| Criterion | Level | Points | Answered by | Evidence |
|---|---|---|---|---|
| Encryption in transit and at rest with managed keys | Managed | 24 / 24 | CapturedStep 5 — Environment & Security | TLS 1.3 in transit, AES-256 at rest, keys held in an HSM. |
| Identity federation with multi-factor authentication enforced | Managed | 25 / 25 | CapturedStep 5 — Environment & Security | Microsoft Entra ID over SAML 2.0, MFA enforced organisation-wide. |
| Access reviews current | Defined | 11 / 17 | Recorded in interviewInterview — Risk & Compliance, 5 Aug 2026 | Quarterly reviews are performed and evidenced. Privileged access is reviewed on the same cycle rather than more often. |
| Least-privilege service accounts for vendor access | Defined | 11 / 17 | Observed by the scanRead-only scan — audit log, 5 Aug 2026 | SVCACCT_SMARTERFI_RO holds *USE and no *CHANGE. The write-permission check was attempted and denied, and the denial is in the log. |
| Data classification applied per domain | Initial | 6 / 17 | CapturedStep 3 — Data Domains | Domains carry NPI, PCI and SAR-confidential markings. The markings are not yet mapped to what each one permits a vendor to do, outside this record. |
Existing AI & Automation FootprintEstablished66
Strongest: rules-based automation in production. Weakest: machine-learning models in production — not started. Reference band 50 — +16 against it.
5 criteria, totalling 66 of 100 points
| Criterion | Level | Points | Answered by | Evidence |
|---|---|---|---|---|
| Rules-based automation in production | Managed | 30 / 30 | Recorded in interviewInterview — SVP Operations, 5 Aug 2026 | Yellow Hammer BSA runs rules-based fraud and AML alerting in production, tuned quarterly. |
| Automation coverage across business lines | Defined | 13 / 20 | Recorded in interviewInterview — SVP Operations, 5 Aug 2026 | Deposit operations and BSA are automated. Lending and finance are manual end to end. |
| Staff familiarity with AI-assisted workflows | Defined | 13 / 20 | Recorded in interviewInterview — SVP Operations, 5 Aug 2026 | The executive team uses general-purpose assistants daily. Branch staff have had no exposure. |
| Machine-learning models in production | Not started | 0 / 20 | Recorded in interviewInterview — SVP Operations, 5 Aug 2026 | None. Every production decision rule is hand-written and reviewable. |
| A named owner for automation initiatives | Managed | 10 / 10 | Recorded in interviewInterview — SVP Operations, 5 Aug 2026 | Dana Whitfield, SVP Operations, with time formally allocated. |
Model Risk & Governance ReadinessDeveloping45
Strongest: vendor model risk inside third-party due diligence. Weakest: independent validation policy — not started. Reference band 48 — -3 against it.
6 criteria, totalling 45 of 100 points
| Criterion | Level | Points | Answered by | Evidence |
|---|---|---|---|---|
| Model inventory maintained | Not started | 0 / 25 | Recorded in interviewInterview — Risk & Compliance, 5 Aug 2026 | There is no inventory of models or decision rules. The BSA rule set is documented inside the vendor product and nowhere else. |
| Independent validation policy | Not started | 0 / 15 | Recorded in interviewInterview — Risk & Compliance, 5 Aug 2026 | No validation policy exists, and no function is designated independent of model development. |
| Model risk guidance alignment programme (FDIC FIL-22-2017) | Initial | 5 / 15 | Recorded in interviewInterview — Risk & Compliance, 5 Aug 2026 | FIL-22-2017, which adopts the SR 11-7 principles for FDIC-supervised institutions, has been read and circulated. No gap assessment has been performed and no programme is dated. |
| Vendor model risk inside third-party due diligence | Managed | 15 / 15 | Recorded in interviewInterview — Risk & Compliance, 5 Aug 2026 | The third-party risk programme is mature and covers vendor-supplied analytics, with annual reassessment. |
| Board and committee oversight of AI use | Managed | 15 / 15 | Recorded in interviewInterview — Risk & Compliance, 5 Aug 2026 | The technology committee has a standing AI agenda item and minutes it to the board quarterly. |
| Change control over production analytics | Defined | 10 / 15 | Recorded in interviewInterview — Risk & Compliance, 5 Aug 2026 | Changes go through the standard IT change board. There is no separate gate for a change that alters a decision rule. |
Organizational & Change ReadinessEstablished67
Strongest: executive sponsorship secured. Weakest: frontline enablement planned — not started. Reference band 54 — +13 against it.
5 criteria, totalling 67 of 100 points
| Criterion | Level | Points | Answered by | Evidence |
|---|---|---|---|---|
| Executive sponsorship secured | Managed | 28 / 28 | Recorded in interviewInterview — SVP Operations, 5 Aug 2026 | The CEO sponsors the programme and it is minuted. Budget is allocated for the current year. |
| Project owner named with time allocated | Managed | 18 / 18 | Recorded in interviewInterview — SVP Operations, 5 Aug 2026 | Dana Whitfield owns the programme with a formal time allocation; Marcus Reyes owns delivery. |
| Frontline enablement planned | Not started | 0 / 27 | Recorded in interviewInterview — SVP Operations, 5 Aug 2026 | No training plan, no enablement owner and no dates. The programme currently stops at the executive team. |
| Change communication plan | Initial | 3 / 9 | Recorded in interviewInterview — SVP Operations, 5 Aug 2026 | Announcements are drafted per project. Nothing is standing or scheduled. |
| Prior technology change delivered successfully | Managed | 18 / 18 | Recorded in interviewInterview — SVP Operations, 5 Aug 2026 | The Banno Digital rollout landed on schedule in 2025 with the same sponsor and delivery owner. |