Examination Procedures – Compliance Guru

29 Apr 2015

Hot Topics Tom Hinkel 6 Comments

FFIEC Issues Stealth Update to BCP Handbook

This caught me by surprise as it was not formally announced in the “What’s New” section, but the Appendix J update to the Business Continuity Planning Handbook apparently constituted a complete update to the Handbook. Here is what the press release said in part:

The Federal Financial Institutions Examination Council (FFIEC) members today issued a revised Business Continuity Planning Booklet (BCP Booklet), which is part of the FFIEC Information Technology Examination Handbook (IT Handbook). The update consists of the addition of a new appendix, entitled Strengthening the Resilience of Outsourced Technology Services. (emphasis added)

If you only focused on the last sentence (as I did), you would think all they did was add an appendix to the existing booklet. But the first sentence states that they issued a revised booklet. And sure enough, they changed the date.

Here is the old booklet:

Cover page from 2008 FFIEC_IT_Booklet_BusinessContinuityPlanning

And here is the new booklet:

Cover page from 2015 FFIEC_IT_Booklet_BusinessContinuityPlanning

I’ve written about the wide-ranging implications of “Appendix J” previously. In comparing the old and new BCP booklets I was unable to find any other changes in the document except the addition of Appendix J, and some changes to Appendix A. Regular readers know that each of the 11 booklets has an Appendix A which contains the examination procedures. The message here is that the FFIEC considered the addition of Appendix J significant enough to warrant new examination procedures, and a whole new handbook with a new revision date!

7 Reasons Why Small Community Banks Should Outsource IT Network Management

I’ve gone through Appendix A of both the new booklet and the previous booklet and highlighted all of the changes. If you’re interested in how your next BCP exam might differ, you can download a copy of my marked-up document here. The complete BCP Handbook is here.

28 Mar 2012

From the Field Tom Hinkel 0 comment

CFPB Examinations Are Coming – UPDATE 2

UPDATE 2 – June 2012: Memorandum of Understanding issued on CFPB examinations

Examinations are coming, but hopefully they won’t impose too much of an additional burden on you. At least that is the intent of an MOU was recently signed between the CFPB and the other Federal regulators (Federal Reserve, NCUA, FDIC and OCC). The MOU provides for information sharing among and between all agencies in order to minimize unnecessary duplication of examination efforts, and provides guidelines for “Simultaneous and Coordinated Examinations” between the agencies. So expect additional visitors during future examinations, but if they truly expect to achieve the stated objective to “minimize unnecessary regulatory burden on Covered Institutions” they could start by doing away with CFPB examinations entirely.

UPDATE 1 – May 2012: Ramping Up…

Coming soon to your financial institution –

Dear Board of Directors:

Pursuant to the authority of the Dodd-Frank Wall Street Reform and Consumer Protection Act, the Consumer Financial Protection Bureau (CFPB) performed a risk-focused examination of your institution. The examination began on April 1, 2012. The following report summarizes the findings of our examination.

Any matters of criticism, violations of laws or regulations, and other matters of concern identified within this Examination Report require the Board of Director’s and management’s prompt attention and corrective action….

Although by law the CFPB will only examine large depository institutions (assets greater than $10B) individually, Section 1026 extends coverage to smaller institutions on a sampling basis. This means all institutions can eventually expect a visit from CFPB examiners (either with or without your primary federal regulator) at some point in the future. And it is my opinion that the influence of the CFPB will continue to expand to all financial institutions regardless of size. Consider the following:

The CFPB is now one of the agencies comprising the inter-agency council of the FFIEC (replacing the OTS). This means that CFPB will have input into all FFIEC guidance going forward.
The head of the CFPB sits on the FDIC Board of Directors
So far, 19 (Regs. B – P, V, X, Z & DD) out of the total of 39 Regulations have been turned over to CFPB for enforcement. (I wonder if including Reg E will affect all electronic funds transfers, or only those initiated by non-business customers? I find it hard to believe that there would be 2 sets of standards.)

So they are coming, but believe it or not there is good news. Not only are they telling you what they are looking for ahead of time, they are giving you lots of helpful templates to fill out in preparation. True, the templates are for their examiners, but there is no reason why you can’t use them too. Particularly helpful is the Consumer Risk Assessment Template which CFPB examiners will use to determine inherent risk, which is then reduced by the appropriate controls to arrive at the overall risk (also called residual risk). This table represents the summary of the consumer risk assessment process:

Notice that if the inherent risk is high, the residual risk can be no lower than moderate, regardless of the strength of the controls. I think this is significant because of the potential implications for all risk assessments going forward. Remember, CFPB now has a seat at the FFIEC (and FDIC) table.

But consider this…could we be looking at a fundamental change in how all risk assessments are conducted, and examined, in the future? One single standardized risk assessment template for all risks? Inherent risk levels are pre-defined, and control strength is pre-determined, making residual risk a purely objective calculation. The complete lack of subjectivity means that all examiners evaluate all institutions against the exact same set of standards. No exit meeting surprises, no unexpected CAMELS score downgrades, no spending hours and hours preparing for one area of compliance, only to have the examiners focus on something else.

So could the influence of the CFPB be a smoother, more predictable examination experience overall? Or am I dreaming?

09 Aug 2011

From the Field Tom Hinkel 0 comment

Examination Experience Survey – preliminary results

Although the survey is still open, I wanted to discuss one particular trend that I find interesting. (If you’ve already participated, thank you! Please pass the link on to a colleague at another institution. If you haven’t had a chance to fill it out, please do so. The survey will remain open until 8/19).

One of the questions is “During your last examination, did you challenge any of the findings with the examiner?” So far, 41% of you have challenged findings…

…and of those that did, almost 70% were successful getting the finding removed or modified in the final exit report…

I was surprised by a couple of things. First, that so many of you actually challenged the examiners. I think this is a direct result of proper examination preparation. Fully 85% of you felt that your examination experience was either “pretty much as expected”, or “a few curve balls, but not bad overall” This makes perfect sense…proper preparation leads to fewer findings, which leads to confidence that you’re doing the right things, and that makes it easier to stand up for what you are doing even though it may differ slightly from examiner expectations. The key is in understanding the root cause of the examiner finding.

So I was also surprised that the number of successful challenges wasn’t even higher. Even if your procedures differ from expectations, if you can demonstrate that you are still effectively addressing the root cause, you will usually have success getting the finding removed or modified in the final report. This next statistic may be telling in that regard…even though 73% of you used an outside consultant to assist with exam questionnaire preparation, only 41% used a consultant to assist with post-exam responses.

Again, the survey will remain open until 8/19, and I’ll be posting additional findings shortly thereafter. Stay tuned!

31 Jan 2011

From the Field Tom Hinkel 0 comment

OTS Using New IT Examination Questionnaire

I’m not sure if this is being used across the board for all OTS exams, or just regionally, but the new pre-examination form (officially called PERK, or Preliminary Examination Response Kit) is significantly more comprehensive than before. It’s 10 pages in length, and has the following 11 categories:

Audit (11 questions)
Management (8 questions)
Development & Acquisition (14 questions)
Outsourcing (7 questions)
Operations (8 questions)
Business Continuity Planning (6 questions)
Information Security (20 questions)
EBanking (12 questions)
Remote Deposit Capture (20 questions)
Wholesale Payment Systems (8 questions)
Retail Payment Systems (14 questions)

If these categories look familiar, they should…they are the 12 FFIEC IT Examination Handbooks, plus RDC (less Supervision of Technology Service Providers). All the OTS has done is take the Handbooks, and extract a few questions from Appendix A (Examination Procedures) of each one.

The institution that received this new exam questionnaire format is about $1B in size, and it could be that it’s only being used for larger institutions. But given that I had previously predicted an overall increase in the level of IT scrutiny, it may also be the start of the trend.

What OTS institutions can do in the meantime is become familiar with the Tier I Examination Procedures in the back of all of the IT Examination Handbooks. Prepare by using them as your own pre-exam checklist (see this). Are you seeing more detailed examination questionnaires? Let me know!

28 Dec 2010

From the Field Tom Hinkel 3 Comments

Looking back – 2010 compliance hits & misses

Every year about this time, I’m asked to look ahead to the upcoming year and prognosticate on regulatory compliance trends. I intend to do just that in a future post, but today I wanted to do something very few other prognosticators do…look back at last years’ predictions and see which ones hit and which missed (and why).

Here was the list of 2010 trends as I saw them early last year:

Risk Assessments –New standards and expectations
Documentation–Who, What, How and Why
Disaster Recovery –Compliant and Recoverable
Vendor Management –Trust but Verify

Overall I scored 2 hits and 2 misses, although to be fair the misses are more along the line of “not yet hits”. Here is how 2010 actually shaped up:

Risk Assessments – miss. This prediction was taken from the Winter 2009 FDIC Supervisory Insights Newsletter article entitled “Customer Information Risk Assessments: Moving Toward Enterprise-wide Assessments of Business Risk”. It described how examiners should start to evaluate risk on an enterprise-wide basis instead of simply focusing on information security risks. I predicted that examiners would start to adjust their examination procedures for the new criteria in 2010, but it hasn’t manifested itself in examination work papers yet. However, some of the enterprise-wide risk criteria has made its way into various risk assessment best practices. Criteria such as strategic risk, operational/transactional risk, reputation risk and legal/regulatory risk are now part of the vernacular for disaster recovery, retail payment systems and new technology risk assessments. We’ll call this a miss…for now.
Documentation – hit. The vast majority of audit and examination findings I’ve seen this year we’re not related to missing or insufficient policies or procedures, they were due to the institutions inability to document (prove) that they were following their own procedures. Expect this trend to continue in 2011.
Disaster Recovery – hit. Both auditors and examiners are finding fault with DR plans that do not strictly conform to the FFIEC guidance. Specifically, they must contain a business impact analysis, risk assessment, risk management and testing sections, and in that order. A non-compliant plan that may even be able to demonstrate (through testing) recoverability will still be written up. (More here.)
Vendor Management – miss. With the increasing reliance of financial institutions on third-party vendors, I predicted that 2010 would be the year that the examiners started scrutinizing vendor management programs more closely. It hasn’t happened…yet. It may be because of the continued overwhelming emphasis on asset quality during the safety and soundness examination, but I’m leaving this on the list for 2011. Asset quality will undoubtedly still dominate in 2011, but there are indications that the pendulum is starting to swing back around. (More on that later.)

My next post will be my predictions for 2011. I’m also collecting survey responses from auditors and examiners on where they think the areas of focus will be, and I’ll report that in early 2011 as well.

All the best for a Happy and Compliant New Year!!

24 Nov 2010

From the Field Tom Hinkel 1 Comment

Thankful for…Appendix A?!

When you were a kid, you hated the “pop quiz” right? But if the teacher allowed you to use your notes and textbooks, you felt like you at least had a fighting chance. I’ve taken both proctored and “open book” certification exams, and I’ve always felt that open-book exams more accurately reflected how most of us retrieve and use information. Most of us can’t possibly commit everything we need to know to memory, but if we know where to go to get the information, we have a fighting chance of finding the right answer.

That’s exactly how it is with an audit or examination. In my position I assist many many customers with audits and examinations. I see a lot of folks treat the pre-exam experience as a “pop-quiz”, with associated high anxiety levels. They dread the unpredictability of both the “test questions” and the correct answers. “What are they going to ask…and how should I respond?” But in reality, all IT examinations are actually open-book, and the books are the FFIEC IT Examination Handbooks. And the best part is that the Handbooks contain both the questions and the answers!

In the back of every single one of the 12 Handbooks is a section titled “Appendix A – Examination Procedures”. All of your examiners’ questionnaires and work papers are drawn from these sections. Granted, most of the examinations use only a small sub-set of the items in Appendix A, but if you use this section as a quick checklist at least you’ll know how prepared you are. In the past couple months, I’ve heard two different FDIC IT examiners make the same statement when asked “how do we know that we’re compliant…?”, and the answer was “easy, because we give you the answers up front!”

So there’s one more thing to be thankful for tomorrow!

I hope you have a wonderful Thanksgiving!