Sunday, April 27, 2014
The compliance examiners are coming! It is time to get everything together to
prepare for the onslaught right? Time
to review every consumer loan that has been made and every account that has
been opened in the last 12 months, right? Not necessarily! The fact of the matter is that the compliance
examination is really an evaluation of the
your compliance management program (“CMP”). By approaching your examinations and audits
as an evaluation of the effectiveness of your overall CMP, the response to the
news of an upcoming review becomes
(almost) welcome.
The
Elements of the CMP
There is really no “one size fits all” way to set up a strong
compliance program. There are, however,
basic components that all compliance management systems need. These components are often called the pillars
of the CMP. The pillars are:
·
Policies and procedures
·
Internal Controls
·
Management Information systems
· Training
The relative importance of each of these pillars depends on the
risk kevels at individual banks. The
compliance examination is a test of how well the bank has identified these
risks and deployed resources. For
example, in a bank that has highly experienced and trained staff couple with
low turnover, the need for fully detailed procedures may be minimal. On the other hand, at a bank where new
products are being offered regularly, the need for training ca be
critical. The central questions, have
you properly identified the risks that exist at your bank and having done so,
have you taken the necessary steps to mitigate risks. Making the CMP fit Your Bank
Making sure that your CMP is right-sized starts with an
evaluation of the bank is doing and the inherent risk in that activity. For example, consumer lending comes with a
level of risk. Missed deadlines,
improper disclosures or misinterpretations of the requirements of the
regulations are risks that are inherent in a consumer portfolio. In addition to the risks inherent in the
portfolio are the risks associated with the manner in which the bank conducts
it consumer business. Are risk
assessment conducted when a products is going to be added or terminated? In many cases. both decisions can create
risks. For example, the decision to
cease HELOC’s may create a fair lending issue; while the decision to start
making HELOC’s has to be made in light of the knowledge and abilities of the
staff that will be making the loans and the staff that will be reviewing for
compliance.
We suggest that compliance has to be a part of the overall
business and strategic plan of a bank.
The best way to make sure that the CMP is appropriate for the bank is to
include compliance in all of the business decisions. The CMP has to be flexible enough to absorb
changes at the bank while remaining effective and strong.
The Test of the
CMP
Probably the most efficient way to determine the strengths and
weakness of the CMP is by reviewing the findings of internal audit, and
examinations as well as quality control checks.
When reviewing these findings what is most important is getting to the root
of the problem. Moreover, we suggest
that not only the findings , but the recommendations that can be found in
examination and audit reports can be
used to help “tell the story” of the
effectiveness of the CMP. As the Bank
receives its readout of findings and recommendations, it is very important to
ask the examiner or auditor “In your opinion, what was the cause of this
finding?” Generally, we believe that you
will find that the answer you receive will be candid and extremely helpful in addressing the problem. Let’s face it, sometimes findings occur when people
have bad days. On those bad days, even
the secondary review did not quite catch the problem. For the most part, these are the types of
findings that keep examiners up at night.
Addressing
Findings
We suggest a five step process to truly address findings and
strengthen the CMP.
1. Make sure that the compliance staff truly understands the nature
of the finding. This may sound obvious,
but far too many times there is a great deal loss in translation between the
readout and the final report. Many of
our clients have stated that they felt like what was discussed at the exit
doesn’t match the final report they receive.
We recommend fighting the urge to dismiss the auditor/examiner as a
crank! Call the agency making the report
and get clarification to make sure that concern that is being express is
understood by bank staff.
Not only does determining the root cause of a problem make the
response more effective, but in doing so, the CMP will be strengthened. It may be easy to see that a bank has a
problem with disclosing right of recession disclosures. It may be harder to see that the problem is
not the people at all, but that the training they received is confusing and
ineffective. Only by diving into the
root cause of the problem can the CMP be fully effective.
We have attached a suggested form for following findings and
addressing the root cause