They say change is constant and that’s never been truer than now. In our current reality of sheltering in place and social distancing, each day presents new challenges and opportunities.
TCA’s article “COVID-19 Business Impact: What Can You Do to Help?” focuses on how institutions can help customers during the current pandemic, and on the potential regulatory implications to consider when modifying processes and obligations. When you try to help customers, keep in mind that your regulatory compliance risk likely will increase, so it is wise not to ease up on your Compliance Management System plan.
The Federal Reserve announced Wednesday that it will suspend examinations for institutions under $100 billion in assets “except where examination work is critical to safety and soundness or consumer protection.” The Fed intends to evaluate this methodology during the last week of April. For institutions over $100 billion, the Fed will defer a “significant portion” of planned examinations based on its “assessment of burden on the institution, the importance of the exam to their supervisory understanding of the firm, consumer protection, or financial stability.”
It is likely the OCC and FDIC will issue similar announcements. A change in the examination schedule is not a free pass to suspend your internal monitoring and audit schedules. Once examinations resume, regulators will still expect to see that you have been managing your compliance risk. In addition, the time to discover an errant procedure, process, or system parameter is now -- not during the exam.
Just as financial institutions have adjusted daily operations to comply with federal and state mandates for social distancing and shelter-in-place mandates, so has TCA. We are actively working with our clients to perform all engagements remotely, ensuring that you can still proactively manage your compliance risk in A Better Way.
TCA has successfully performed offsite reviews for several years and our technology allows for an engaging and effective remote review process.
Ensuring a Successful Remote Review
Whether you are preparing for your first offsite engagement due to the current pandemic or you’ve been using our offsite review option for years, here are some tips to ensure a successful review.
Prior to the Engagement:
How do I provide the documentation for review? TCA uses both a secure cloud environment with ShareFile as well as secure and encrypted email. We can also access your systems remotely via a VPN or directly access your loan origination systems, such as Encompass.
ShareFile is perfect for uploading a large amount of data. Allowing us to access your systems remotely works well, though it may require your Management’s approval. It requires help from your IT Department. Since your IT Department likely will require additional information to set up VPN or system access, require additional vendor documentation, or other requirements, it’s important to test the system in advance. Secure email works great for the odd document or two.
How should I organize the documentation? You will receive a request list three to four weeks prior to the start of the review. The assigned TCA Lead Consultant will establish folders in your secure Client Upload folder that correspond to each functional area included in the review. Items from the request list should be uploaded to the appropriate folder.
Should I upload all PDF documents? When possible, please provide searchable files. TCA prefers MS Word or Excel files when available because they allow us to more easily research data. When providing PDF documents, please use a program that allows you to print directly to a .pdf file from its source document because such files are searchable. Scanning printed documents creates a “picture” of the file, making it challenging to find the information required for reviews.
When should I upload the review documents? TCA encourages you to upload request documentation one to two weeks prior to the engagement. This allows the Lead Consultant to make additional testing requests and sample selections before the review starts.
During the Engagement:
Entrance Meeting – An entrance meeting is critical. It’s an opportunity to confirm the engagement scope, discuss how questions or requests should be communicated, identify the time for daily check-in calls, schedule an exit meeting, and discuss any open documentation requests. In addition, while the products and services offered by institutions are similar, each client has different product features, services, and acronyms, so a discussion at the outset provides clarity.
TCA uses Microsoft Teams for audio and video conferencing, which provides both screen sharing and video conferencing. TCA consultants are happy to test connections before an engagement so that your IT department can grant applicable permissions and install any additional software that is needed.
Daily Calls/Matrix – Since establishing daily communications is critical to any successful offsite review, TCA relies on a Daily Communications/Tracking Matrix. This document keeps you up to date on the progress of the review, our findings, and questions or requests. The Matrix is sent to whomever you have designated as the contact or contacts for the review. Many clients find it helpful to set a specific time each day to go over the matrix with TCA, while others only reach out if there are questions. If you are new to an offsite review, a daily call may work best.
Supporting or Additional Documentation – After the initial documents are uploaded, any additional information requested or documentation to clear a finding or answer a question should be uploaded to the Addt’l Supporting Docs We know your time is valuable, and this approach eliminates the guessing game about where to locate documentation to address findings questions or requests.
Ask Questions – If you need clarification about a document request, a comment on the Daily Matrix or an update on the review, you can always contact the Lead Consultant by email or phone. Keep in mind that there’s no such thing as a silly question. Your TCA consultant shares your goal of helping you and your institution identify and manage risk.
After the Engagement:
Vetting findings – The purpose of the Daily Matrix is to provide an opportunity for your Team to vet findings prior to the exit meeting. However, we understand that staff may be stretched thin and that key business unit leaders, if they are working remotely, may be unable to access information. Discuss such challenges with your Lead Consultant. We’re flexible and we will find the best way to complete the work to accommodate your circumstances. To ensure the timely completion of our review we will give you a reasonable due date to submit follow-up documentation.
Report and Workpapers – Once the agreed-upon date for submitting documentation has passed, we will provide a report of our findings. Since examiners also ask to review third-party workpapers, we will provide these to you via encrypted email after the report is finalized.
Board/Audit Committee Presentation – A great way to demonstrate that our reviews are independent is to have TCA present its report to your Board or Audit Committee. Documenting this in meeting minutes demonstrates strong board and management oversight of the compliance function. If we are unable to attend in person due to travel restrictions, we’re happy to make a presentation remotely.
Whether your review is onsite or offsite, TCA’s compliance professionals are committed to delivering A Better Way to manage your compliance risk. Contact us at [email protected] or 800-934-7347 today to discuss options for your next review.
