Pre-Examination Planning PDF

II. Compliance Examinations — Pre-Examination Planning Pre-Examination Planning (PEP) Introduction The objective of the pre-examination planning process is to collect necessary information to understand an institution and the risks of consumer harm prior to the start of an examination. This informat...

II. Compliance Examinations — Pre-Examination Planning Pre-Examination Planning (PEP) Introduction The objective of the pre-examination planning process is to collect necessary information to understand an institution and the risks of consumer harm prior to the start of an examination. This information allows the Examiner-inCharge (EIC) and the examination team to plan and conduct the examination, to develop the scope of the examination, and to accomplish supervisory objectives in an efficient and effective manner. This chapter discusses the three phases of the preexamination planning process and usage of the PreExamination Planning System (FOCUS PEP), which is a web-based automated system used to generate the various pre-examination planning documents. The pre-examination planning process involves the following three phases: 1. 2. 3. Information Package (IP) Pre-Examination Planning Phase 1 (PEP-1) Pre-Examination Planning Phase 2 (PEP-2) Information Package (IP) questions; however, the FS, SE, EIC, or other examination staff should not request or require written responses from the institution. After contacting institution management, the FS, SE, or designee submits the IP to the institution according to the previously stated timing requirements. To facilitate efficient and secure exchange of information, the FS or SE should determine the institution’s willingness to use applications, such as the Enterprise File Exchange (EFX), that provide a secure method for financial institutions to exchange information with the FDIC. 3 When the institution is willing to use such applications, the FS, SE, or designee should initiate a session and electronically submit the IP to the institution. When the institution is unwilling to use secure applications for the electronic exchange of examinationrelated information, the FS, SE, or designee should use an alternative delivery method (e.g., encrypted e-mail, express mail courier service) that meets the security measures discussed in the FDIC’s policies for the exchange, use, and storage of information. 4 Each field office will establish procedures to ensure the FS, SE, or designee (1) provides the IP to the institution in a timely manner; (2) records the IP sent date in the System of Uniform Reporting of Compliance and CRA Examinations (FOCUS); and (3) if applicable, records any reasons for timing delays in FOCUS. The examination planning process begins with the Field Supervisor (FS) or the Supervisory Examiner (SE) calling the institution’s management to inform them of the projected start date of the examination or visitation, explaining that an IP will be sent, and discussing how the IP will be provided. 1 The FS or SE submits the IP to the institution no less than 90 calendar days before the projected start date of the examination. 2 The IP is designed to increase banker awareness of the examination process prior to the examination; to promote open communication with examination staff; and to ensure that the institution’s management team knows what to expect during the examination and where to go in the event their expectations are not met. The FS or SE explains that the IP includes a list of interview questions, which will help the EIC develop an examination plan and an information and document request list tailored specifically to the institution’s activities. The interview questions are provided early so the institution’s management team can prepare to discuss them with the EIC and can invite the appropriate persons to participate in the pre-examination interview that occurs several weeks before the examination start date. The institution may elect to provide written responses to the pre-examination interview The IP module in FOCUS PEP is used to produce the IP, which includes a standardized introductory letter that provides an overview of the examination process; discusses various resources available that explain the examination process; identifies the appropriate communication channels for any concerns about the examination process or the resultant ratings; and provides contact information for the FS and/or the SE. 1 3 T he FS or SE is responsible for scheduling and developing a timeline of activities and, therefore, responsible for the initial communication with the institution. Other FS or SE duties, such as setting up the secure exchange of information with the institution or actually submitting the IP to the institution, can be delegated to other appropriate staff. 2 Exceptions to this timing requirement can occur on a limited basis when the FS or SE is unable to contact institution management due to unforeseen difficulties. In such circumstances, the FS or SE should send the IP as soon as possible and document reasons for the delay. FDIC Compliance Examination Manual –November 2023 The IP letter has been standardized and automated within FOCUS PEP and should be consistently used by all field offices without changes. A sample IP letter is included in this M anual (see Section III). If electronically submitting the IP to the institution, the FS, SE, or designee should convert the IP letter to an Adobe portable document format (.pdf). Supervisors should also follow any national or regional instructions governing the use of electronic signatures for examination-related documents. In the absence of such instructions, a supervisor can either use his or her typed name as an electronic signature, using the same font as the body of the letter, or use Adobe’s “Fill & Sign” feature. Refer to examination instructions about EFX and offsite examination capabilities for user guides and other reference materials. 4 Examination staff must understand and comply with the directives, memoranda, and guidance governing the use and security of confidential examination information. II-4.1 II. Compliance Examinations — Pre-Examination Planning Lastly, as part of the examination planning process, the FS or SE schedules examiners for PEP-1 and PEP-2. In particular, the FS or SE will select the EIC and schedule sufficient dedicated time for the EIC to conduct all activities of PEP-1 and PEP-2 prior to the examination start date. As a general rule, the EIC (or Acting EIC) should conduct PEP activities to have sufficient time to learn about the institution and prepare an examination plan tailored to the institution’s areas of highest risk. Other examiners may conduct PEP activities on a limited basis when scheduling conflicts arise or limited staffing resources exist. Additionally, if examiners other than the EIC will perform the CRA or fair lending reviews, then those staff members should be scheduled sufficient dedicated time, when possible, to perform CRA- and fair lending-related examination planning activities so that the results are available for the EIC’s review and consideration. Data Validations: For the largest Home M ortgage Disclosure Act (HM DA) reporters (over 500 LAR lines) and/or Community Reinvestment Act (CRA) reporters, validation testing should be conducted in advance of scheduled fair lending and CRA examinations. This approach will allow the institution to resolve any data errors so the examination can proceed without significant delay. In addition, validation testing must be conducted for HM DA Outlier reviews prior to the start of the examination. For examinations of all other reporters, the validation testing will generally be conducted during the examination. However, a field office has the option to perform a data validation prior to the examination start date for other institutions if the field office has sufficient resources to complete it. The HM DA validations should be conducted following the FDIC HM DA validation procedures, considering the scale and complexity of the institution’s mortgage lending activities and an overall assessment of the institution’s prior practices and compliance risk profile. A HM DA/CRA Validation Letter is to be provided to institutions when data validations occur prior to any examination. A data validation letter has been standardized and included in the IP module of FOCUS PEP and should be used consistently. This letter is either sent with or after the IP to allow sufficient time for the data validation process. The letter should be sent using the same secure delivery method established for providing the IP. If HM DA Data Analysts will be used for the validation process, the FS or SE should communicate this with the institution, either verbally or in the letter. Pre-Examination Planning Phase 1 (PEP-1) The risk assessment of the institution begins during PEP-1. Every institution has inherent risk based on strategic plans, products and services offered, past supervisory actions, business activity, and other factors. PEP-1 starts the process of identifying and documenting risk based on the institution’s structure, supervisory history, financial performance, and market area. The various activities performed during PEP-1 are meant to promote critical II-4.2 thinking about the possible inherent risks in the institution being examined. PEP-1 consists of the following activities: • • • • Gathering information about the institution from both internal and external sources; Contacting the institution to conduct the preexamination interview (PEP interview); Preparing and sending the Entry Letter to the institution along with the Compliance Information and Document Request (CIDR) that primarily requests CM S-related information and documents; and Beginning Section 1 of the Assessment of Risk of Consumer Harm (ARCH) and Section 1 of the Fair Lending Scope and Conclusions memo (FLSC). This activity is optional during PEP-1. The ARCH and FLSC can be started to the extent possible and when time or examination scheduling permits; however, most work on the ARCH will occur during PEP-2 and most work on the FLSC will occur during PEP-2 and the examination. The EIC should begin PEP-1 no less than 45 calendar days prior to the scheduled start date of the examination. However, institutions must have at least 30 calendar days to complete the CIDR and provide requested documents. Longer time periods may be necessary based on the institution’s size, resources, and complexity. The EIC should communicate with the institution’s management during the PEP interview to determine a sufficient amount of time to provide the requested materials. This timeframe is also discussed in the Entry Letter. Gathering Available Information The EIC should first concentrate on gathering as much of the information as possible from FDIC records and databases and from publicly available sources before obtaining information from the financial institution. The following is a list of some key documents and information the EIC should obtain for review because of their relevance to the financial institution’s compliance posture. FDIC Records and Databases • • • • Data Gathering Tool, which compiles institution, examination, supervisory, and financial information from multiple FDIC systems and databases; Prior ARCH, FLSC, and other information from FOCUS or the Regional Automated Document Distribution (RADD); Previous Reports of Examination (ROEs) and supporting workpapers for compliance, risk management, trust, and information technology; Prior corrective actions (such as restitution) and responses to ROEs; FDIC Compliance Examination Manual – November 2023 II. Compliance Examinations — Pre-Examination Planning • • • • • • • Supervisory plans (for large and/or complex institutions, or others, as available); CRA Performance Evaluations; Demographic data for CRA assessment area(s) or market area(s); Uniform Bank Performance Reports (UBPRs) and Reports of Condition and Income (Call Reports); FDIC monitoring reports; Complaint and correspondence files; and Applications in process. External Sources • • • • • Previous years’ HM DA and CRA data disclosure reports; Content of the financial institution’s website; Public records, such as securities filings; Newspaper or website articles that raise potential examination-related issues; and Community contacts (for CRA evaluations). PEP Interview The PEP interview questions are maintained in the Compliance Pre-Examination Request Package (C-PREP) module of FOCUS PEP and updated on a periodic basis. The EIC will contact the institution and arrange a PEP interview to be conducted either by telephone, a secure communication platform (such as M icrosoft Teams or another FDIC-approved system), or through an in-person discussion. The purpose of the interview is to gather current information to understand the institution’s risk profile, size, complexity, and the types of products or services offered. The interview questions are provided to the institution with the IP discussed previously. Staff cannot require the institution to provide written answers to the interview questions in advance. If the institution elects to provide written answers, the EIC is still expected to conduct an interview to verify and clarify responses received. While examiners cannot add, revise, or delete interview questions in FOCUS PEP, the EIC should tailor interview questions based on what is learned about the institution through the internal and external data gathering process. This demonstrates that the EIC has performed research to become familiar with the institution. The EIC should also ask any necessary follow-up or additional questions during the PEP interview to understand the institution’s profile and to determine inherent risk. The EIC should also use the interview as an opportunity to answer the institution’s questions about the examination process and to discuss the timing and logistics of the examination, including anticipated on-site and off-site activities. Additionally, the EIC should determine the applicability of the FDIC’s e-Exam Policy, should confirm previously discussed electronic document/data access requirements and delivery method(s) with the institution’s management; and determine off-site examination capabilities. If the institution does not image documents or has had difficulty creating scanned images of records needed FDIC Compliance Examination Manual –November 2023 for FDIC examinations, the EIC may consider alternative options such as conducting an on-site review of these records or visiting the institution to scan the documents. The PEP interview also provides an opportunity to identify the institution’s staff members who will need to be available to the examination team during the examination. This will allow the institution to take steps to ensure, to the extent possible, that those persons are available when needed. Director Involvement: During the PEP interview, the EIC should also inform management that members of the institution’s Board of Directors are welcome to participate in regularly scheduled meetings with examiners or to schedule individual meetings with the EIC, if desired. The EIC should emphasize that such participation is purely voluntary and that a lack of participation will not be viewed negatively. As stated in the memorandum announcing this initiative, “The primary objectives are to improve communication with outside Directors, increase Director knowledge of the examination process, provide an opportunity for Directors to discuss their views with examiners on banking-related matters, and give examiners the opportunity to gain further insight into the experience levels and leadership qualities of bank management.” CIDR and Entry Letter The C-PREP module in FOCUS PEP is used to produce the Entry Letter and Electronic Data Download Instructions and the CIDR. These documents must be tailored, as appropriate, for each institution. After conducting the information gathering and PEP interview outlined above, the EIC (or a designee with whom he or she communicates closely) is required to use C-PREP to customize and create the CIDR based on an institution’s products and services. The interview responses must be input to FOCUS PEP to ensure the CIDR is tailored to request only what is necessary to conduct the examination. C-PREP filters the CIDR to make available certain items based on the institution’s responses to the PEP interview questions. The CIDR created during PEP-1 primarily requests information and documents to assess the CM S, as well as information and some documents to understand the characteristics of products or services offered. The majority of transaction-level documentation will be requested during PEP-2. The institution’s response to the initial CIDR will provide the EIC with enough information to properly scope the examination and to identify products, services, and regulations (PSRs) on the ARCH that exhibit inherent risk not sufficiently mitigated by the institution’s CM S (i.e., residual risks). These residual risks will be the basis for requesting transaction testing-related documentation (e.g., disclosures and loan files) during PEP-2. Also, requesting fair lending-related information through the CIDR will allow the examiner conducting the fair lending review to complete the majority of Section 1 of the FLSC prior to the start of the examination. Thus, the EIC should ensure all applicable fair lending-related information is requested through the CIDR so the examiner conducting the fair lending review has access to this information during the scoping process. II-4.3 II. Compliance Examinations — Pre-Examination Planning When completing the CIDR and requesting items such as minutes, training records, or reports, the EIC indicates the timeframe for the review (e.g., since the previous examination, in the past year, in the last two years). This will help the institution avoid the submission of voluminous information or data not relevant to the examination. Additional information about how to use C-PREP can be obtained from the user guide available within FOCUS PEP. The Entry Letter and CIDR should be provided to the institution in either a paper-based format or an electronic format using the secure delivery method previously established for the examination process. As discussed previously, if electronically providing the Entry Letter to the institution, the EIC (or designee) should convert it to an Adobe portable document file (.pdf). The EIC (or designee) should also follow any national or regional instructions governing the use of electronic signatures for examinationrelated documents. In the absence of such instructions, the EIC (or designee) can either use his or her typed name as an electronic signature, using the same font as the body of the letter, or use Adobe’s “Fill & Sign” feature. The Entry Letter instructs the institution on how to deliver the materials to the EIC or examination team and in what format. As previously discussed, institutions must have at least 30 calendar days to complete the CIDR and provide requested documents. The timing of the request and the turnaround must ensure that the institution has sufficient time to assemble the requested information and the examination team has sufficient time to adequately review the materials. The FDIC prefers the use of applications, such as EFX, that provide a secure method for financial institutions to exchange examination files and information electronically with the FDIC. However, where appropriate and with supervisor approval, the EIC may visit the institution prior to the official start date either to pick up the documents or to review any documents that are confidential or too bulky to duplicate. ARCH and FLS C – S ection 1 The ARCH documents the scope of the examination and assists with prioritization of efforts, time, and resources toward those PSRs with the highest residual risk of consumer harm. The FLSC documents the fair lending review conducted in accordance with the Federal Financial Institutions Examination Council’s Fair Lending Examination Procedures. After conducting the PEP interview and recording the institution’s responses in FOCUS PEP, the ARCH and FLSC can be created in FOCUS PEP. In an effort to make the PEP process more efficient, Section 1 of the ARCH and FLSC have been coordinated with and linked to the PEP interview. Several responses for Section 1 of the ARCH and FLSC will prepopulate based on what is entered into C-PREP from the PEP interview. However, the EIC should review the prepopulated questions and answers to ensure they are correct. The EIC has the option to begin Section 1 of the ARCH and FLSC during PEP-1 using available information gathered. 5 A series of questions helps document various risks identified during examination planning. The ARCH was developed to engage examiner’s critical thinking skills and to focus examination resources on areas presenting the highest degree of consumer harm risk. Additional information about preparing the ARCH is included in this M anual (see Section II – Review and Analysis). Examiners can also find information about how to use the ARCH and FLSC modules in the user guides available within FOCUS PEP. Pre-Examination Planning Phase 2 (PEP-2) During PEP-2, the EIC will conduct an initial assessment of the institution’s CM S to determine how effective the CM S is in identifying, addressing, and mitigating the potential for consumer harm. This information will primarily be obtained from the institution’s responses to the PEP interview and the CIDR. The EIC will continue the process of identifying and documenting inherent risk during PEP-2 based on the institution’s business model and operations. The areas that indicate a moderate or high level of potential consumer harm risk not mitigated by the strength of the CM S will potentially require further evaluation during the examination. In PEP-2, the EIC will finalize the ARCH examination scope and establish specific areas for review or transaction testing. PEP-2 consists of the following activities: • • • • Reviewing the CIDR responses and requested items; Completing the ARCH and completing the majority of FLSC Section 1; Requesting additional documents for PSR transaction testing or the fair lending review; and Getting the ARCH approved. Supervisors will ensure sufficient time is scheduled prior to the examination start date for PEP-2. The amount of time needed to complete PEP-2 will vary based on the size and complexity of the institution. Each field office will establish procedures to ensure that PEP-2 starts early enough to provide sufficient time for the institution to gather additional documents for transaction testing. Review CIDR Responses and Requested Items 5 As indicated previously, if an examiner other than the EIC will perform the fair lending review, then that staff member also has the option to begin parts of the FLSC during PEP-1 if time and examination scheduling permits it. II-4.4 FDIC Compliance Examination Manual – November 2023 II. Compliance Examinations — Pre-Examination Planning The EIC and examination team will review the information and documents provided by the institution in response to the CIDR. If documents necessary to complete the ARCH or to assess fair lending risk, such as Board meeting minutes or monitoring/audit reports, are not provided in response to the CIDR, examination team members may go to the institution during PEP-2 to review this information as time, resources, and travel requirements permit. Follow-up contact with the institution’s personnel during PEP-2 is encouraged to properly answer any questions and to determine the most appropriate examination scope. ARCH Completion and Completing Majority of FLS C S ection 1 Based on the information provided by the institution, the EIC will complete the ARCH. This will involve finalizing Section 1 of the ARCH, as necessary, but will primarily involve completing Sections 2, 3, and 4. Section 3 of the ARCH has also been coordinated with and linked to the PEP interview and the majority of responses will pre-populate. The EIC will identify the PSRs that warrant transaction testing and any additional documentation needed for the examination. Also, based on the fair lending-related information obtained through the CIDR, the examiner conducting the fair lending review should be able to complete the majority of Section 1 of the FLSC prior to the start of the examination. Additional information about completing the ARCH is included in this M anual (see Section II – Review and Analysis). Transaction Testing (TT) Request The EIC will prepare and send a TT Request to the institution based on the scope of the examination and has the option of using the C-PREP module to develop it. The fair lending examiner may work with the EIC to determine if additional fair lending-related documents need to be requested. Documents requested during PEP-2 will largely be transaction-level documentation such as loan files, disclosures, notices, periodic statements, or system parameters, needed for the anticipated examination scope and the CRA, HM DA, and fair lending reviews. When requesting these documents, the EIC indicates the timeframe for the review period (e.g., since the previous examination, in the past year, in the last two years) and the sample sizes. This will help the institution avoid the submission of voluminous information or data not relevant to the examination. These items will generally be made available electronically through the use of secure applications like EFX or other off-site examination tools, as agreed to by the institution and the EIC, or held at the institution for the examination. The EIC will provide the TT Request to the institution’s designated contact, using the secure delivery method previously established for the examination process. Based on the size, complexity, and resources of the institution, FDIC Compliance Examination Manual –November 2023 examiner judgment should be exercised regarding the approximate number of days the institution needs to gather the requested documents. Additionally, it is important that the EIC communicate to the institution which documents are needed at the start of the examination. This communication will help the institution prioritize the TT Request and allow the institution additional time to gather lower priority documents during the examination. If the ARCH is changed to add a PSR subsequent to sending the TT Request to the institution, the EIC has the option to request necessary documents for the additional PSR(s) after the examination starts instead of sending another TT Request. If, however, a PSR is deleted after sending the TT Request to the institution, the EIC should discuss this during the entrance meeting with the institution’s management team and explain why the area will not be reviewed. ARCH Approval The EIC will finalize the ARCH using information obtained during PEP-2 to determine residual consumer harm risk and to establish the scope of the compliance examination. The completed ARCH will be submitted to the FS and all appropriate SEs to ensure that all territory managers can access the ARCH for review and approval. Each field office will establish procedures to ensure the ARCH is approved by the appropriate FS or SE prior to the examination start date. If information is discovered during the examination that requires material changes to the originally approved ARCH, the EIC describes the changes in a scope amendment that is submitted to the FS and all appropriate SEs for review and approval. M aterial changes are generally defined as a PSR change. This may occur when the EIC determines an approved PSR will not be reviewed or when the EIC identifies a new PSR not identified during PEP. PEP Record Retention To ensure consistency in record retention, PEP documents should be maintained as follows: • • • • • • The IP, HM DA/CRA Validation, and Entry letters should be stored in the correspondence folder in RADD; PEP interview questions and answers should be completed within C-PREP and the completed document maintained as an examination workpaper in RADD; The completed CIDR with institution responses should be retained as an examination workpaper in RADD; The final, approved ARCH should be stored as an examination document in FOCUS; The TT Request list should be retained as an examination workpaper in RADD; and The final, approved FLSC should be stored as an examination document in FOCUS. Note: Any supporting documents used in the fair lending II-4.5 II. Compliance Examinations — Pre-Examination Planning review should be retained in accordance with DCP’s Standardized Workpaper Job Aid: FOCUS vs. RADD Minimum Documentation Requirements. II-4.6 FDIC Compliance Examination Manual – November 2023