For each vendor-supplied system, what information should the firm request from the vendor as part of the monitoring programme? How should vendor-provided information be validated?