39.1 Monitoring, Independent Assurance and Risk-Based Scoping

---

1. Core Distinctions Between Monitoring and Independent Testing

In modern bank risk architecture, the Three Lines of Defense framework delineates operational ownership, oversight, and independent assurance:

Compliance Monitoring (2nd Line Activity)

Compliance monitoring is a continuous, periodic surveillance and review mechanism conducted directly by compliance department personnel.

• Core Purpose: To evaluate whether business lines are consistently executing day-to-day operations in compliance with applicable consumer protection laws and internal policies, to identify emerging operational glitches early, and to validate the ongoing effectiveness of first-line controls.
• Cadence & Agility: Operates on an ongoing, high-frequency cycle (e.g., monthly, quarterly, or bi-weekly). Because monitoring is embedded within the compliance function, scopes and cadences can be pivoted quickly in response to operational disruptions or new regulatory mandates.
• Reporting Hierarchy: Findings are formally communicated to business unit leaders, the Chief Compliance Officer (CCO), the Chief Risk Officer (CRO), and the Executive Compliance Committee. Monitoring reports drive prompt operational remediations and inform policy or training updates.

Independent Testing / Compliance Audit (3rd Line Activity)

Independent testing (commonly designated as compliance audit) represents a formal, objective, and comprehensive evaluation of the bank's entire compliance framework.

• Core Purpose: To provide independent, objective assurance to executive management and the Board of Directors regarding the overall adequacy, effectiveness, and design of the institution's Compliance Management System. Independent testing evaluates not only first-line transactional compliance but also scrutinizes the second-line compliance department itself—evaluating whether the CCO's risk assessments, monitoring programs, training modules, and complaint resolution procedures are adequate and functioning effectively.
• Strict Independence Standards: Personnel conducting independent testing should have no operational or administrative involvement in the compliance functions or business processes they evaluate. An internal auditor cannot design a bank policy on Monday and test it on Friday. If a bank lacks an in-house internal audit team with requisite consumer compliance expertise, it should engage an independent external firm reporting directly to the Board.
• Cadence & Governance: Operates on a formal, risk-based audit cycle (typically annual or multi-year). Testing programs, audit workpapers, and formal audit reports are submitted directly to the Audit Committee of the Board of Directors, ensuring uncompromised governance visibility.

---

2. Developing the Risk-Based Monitoring and Testing Plan

Federal regulatory agencies—including the Consumer Financial Protection Bureau (CFPB), Office of the Comptroller of the Currency (OCC), Federal Deposit Insurance Corporation (FDIC), and Federal Reserve Board (FRB)—expect that compliance monitoring and testing programs be risk-based rather than uniform across all banking activities.

Foundation: The Enterprise Compliance Risk Assessment (ECRA)

The annual monitoring and testing plan is directly derived from the bank's Enterprise Compliance Risk Assessment. The ECRA evaluates the inherent compliance risk of every product, service, business unit, delivery channel, and legal entity, assesses the strength of internal controls, and calculates the resulting residual risk:

• Tier 1 (High Residual Risk): Highly complex, heavily regulated, or high-volume activities with severe statutory remedies or penalties. Subject to monthly or quarterly monitoring with substantial sample sizes and annual independent audit. Prominent examples include:
  • TRID (TILA-RESPA Integrated Disclosures, 12 CFR Part 1026 / Part 1024): Loan Estimate (LE) and Closing Disclosure (CD) issuance timing, fee tolerance cures, and changed circumstance validations.
  • Fair Lending (Equal Credit Opportunity Act / Reg B, 12 CFR Part 1002; Fair Housing Act): Underwriting discretion, interest rate and fee pricing exceptions across protected classes, and marketing redlining risks.
  • Electronic Fund Transfer Act (Regulation E, 12 CFR Part 1005): Consumer unauthorized debit dispute processing, 10-business-day provisional credit timelines, and fee disclosures.
  • Bank Secrecy Act / Anti-Money Laundering (BSA/AML & OFAC): Currency Transaction Reports (CTRs), Suspicious Activity Reports (SARs), Customer Due Diligence (CDD), and sanctions screening.
  • Flood Disaster Protection Act (FDPA, 12 CFR Part 22 / Part 339): required determinations for designated loans, escrow requirements, and 45-day force-placement notices.
• Tier 2 (Moderate Residual Risk): Intermediate risk areas evaluated on a semi-annual cadence. Examples include Expedited Funds Availability Act (Regulation CC) exception hold notices, Truth in Savings Act (Regulation DD) annual percentage yield (APY) calculations, and Fair Credit Reporting Act (FCRA / Regulation V) adverse action notices.
• Tier 3 (Low Residual Risk): Well-controlled, low-volume, or administratively stable operations tested annually or through periodic targeted spot-checks (e.g., Children's Online Privacy Protection Act [COPPA], Right to Financial Privacy Act [RFPA]).

Dynamic Triggers for Testing Scope Adjustments

A risk-based plan should not remain static. Compliance leadership should implement dynamic triggers that mandate out-of-cycle reviews or expanded sample sizes when internal or external risk profiles shift:

1. Regulatory Amendments & New Statutory Requirements: Promulgation of final rules (such as revised CFPB rules, small business lending data collection under Dodd-Frank Section 1071, or modernized FDIC Part 328 signage mandates).
2. Product & Channel Launches: Introduction of new lending programs, digital buy-now-pay-later (BNPL) loans, real-time instant payment rails (FedNow), or automated algorithmic underwriting tools.
3. Operational & Structural Transformations: Core banking system conversions, branch acquisitions, loan servicing migrations, or enterprise reorganization.
4. Elevated Complaint Volumes or Emerging Litigation: Sharp statistical spikes in consumer grievances or class-action litigation targeting specific fee practices (e.g., overdraft fee representment or wire fraud claims).
5. Supervisory Findings & Audit Criticisms: Matters Requiring Attention (MRAs), Consent Orders, or formal supervisory directives from primary regulatory examiners.

---

3. Sampling Methodologies in Compliance Testing

Selecting the appropriate sampling methodology determines the validity, statistical defensibility, and practical utility of compliance reviews. Compliance professionals should balance statistical rigor with diagnostic precision.

Methods depend on the objective

Fair lending can use comparative file reviews, statistical analyses or both; not every review legally requires a statistical sample. HMDA resubmission follows the current FFIEC field-level thresholds and agency review, not a blanket 5% or 10% whole-register rule. TILA reimbursement scope depends on the governing rule and facts; statistical extrapolation is not the only authorized approach. Targeted samples identify risks but do not establish an unbiased portfolio error rate.