Introduction
You have just completed your examination, and your regulators have given you their preliminary results. For most of us, you think you know what they are going to do say- there are few things that need to be updated here and there, maybe more training is required. Overall, some enhancements around the edges are necessary, but nothing too serious.
However, this is not at all what you are hearing! Things are dire and enforcement action is being considered! The results of the examination will be discussed with senior management of the regulator and significant changes will need to be made! What happened? How did we get here? There have been no significant changes in your management, your program and your approach. All of these have been considered satisfactory for several examinations in a row and now-boom!
When examination results are surprising, it is natural to respond with shock, anger, frustration and vow that this is the year that you get out of the business! Fear not, all Is not lost! There is a process for responding to examination results that can minimize the impact of an unexpected poor rating.
Read the examinations results thoroughly
While it is understandable to take the view that the results of the examination are simply inaccurate or unfair, it is worth taking the time to read the documents thoroughly. It is extremely rare that the examiners have engaged in a personal attack. They have a job to do that includes reviewing the overall effectiveness of internal controls at your financial institution. Remember that they are responding to the information that they requested and received during the examination process and they are never going to have the same personal investment in your business and your customers that your staff does. Make notes about what you see and what the examiners are saying about your program. Remember that the examination process is a moment in time. Perhaps the findings/issues that are cited have already been identified and addressed. Or the offending customer has been terminated. It is very important to get a complete understanding of what the report/examination findings are saying.
Understand the findings/concerns noted
Where there is a finding or concern noted in a report, it is possible that the cause is the result of a misunderstanding or miscommunication. It’s critically important that both the examiner and the institution communicate about the same set of rules, regulations or laws that apply. A finding is the result of failure to establish internal controls that ensure ongoing compliance with the requirements of a rule. Therefore, it is important that both sides understand the rule, how it applies to the specific institution and what has been identified as a concern. It is not enough to accept that ”In case A, a SAR should have been filed”. There needs to be information about what the rule is on filing SARs, a discussion of the activity being reviewed and why the examiner concluded that a SAR should have been filed. Without a clear understanding of what the actual problems are, there is a likelihood that the problem will persist.
Make sure you include recommendations as actionable
When there is a finding or recommendation in a report one must determine that there is something that is truly actionable and possible. For example, a recommendation that an institution should purchase software to automate its compliance program may require a capital investment that is unreachable. There may be ways to enhance monitoring programs manually without purchase of software. Ultimately, one must understand what recommendations are feasible and actionable.
Find the root of the problem
For every concern or finding that is noted, there is a root issue. Once the results have been thoroughly reviewed and understood and a recommendation has been identified, the underlying cause should be determined. Is the problem a matter of lack of or ineffective training? Is the problem a structural one that requires reorganization? Whatever the issue, without identifying the root cause, attempts to address the finding will be ineffective.
Document the fix of the problem
The problem has now been thoroughly reviewed, understood and the root cause has been identified. Documentation of the steps taken is required. Suppose the root issue of a problem adverse actions not being timely has bene identified as a training issue. The next step is to document the training that has been developed, how it was implemented and the results of the implementation. How else will you know if the training is working!?!
***James DeFrantz is Principal at VCM
For More Information please visit www.VCM4you.com ***