Brandi B. Reynolds, CAMS-Audit, CCI, CCCE
We’ve all been on one (or both) sides of this equation at some point in our careers. You are either the department head of an area going through significant remediation or enhancement and it’s about to be reviewed (or monitored or QC’d)… OR… you’re the reviewer of an area or function that’s going through significant remediation or enhancement. If you are the first, you don’t want items reviewed that predate your remediation – that makes perfect sense. But if you’re the reviewer, you likely have to review an entire scope period, and that period likely includes items that pre-date remediation, and some that don’t.
And so, the dilemma is formed. The area or function in question is considered “in-flight,” yet it must be reviewed.
Stress Relief:
There are ways to make this review less stressful for everyone involved, but it’ll take a little effort before the review. The department head has some homework to do in the planning phase of the review, as does the reviewer.
The department head’s role: To lessen the stress of a review of an area or function that’s “in-flight”, the department head should:
- Be sure to keep a log of the major functions that went through remediation. This log should include dates and a detailed description of what changed.
- Be sure to archive each version of a policy or procedure that changed during the period and indicate what time period each version addressed and what changed. In a department undergoing significant enhancement, policies and procedures may have been updated multiple times during the review period. Department heads have to be careful with “version control” of their policies and procedures.
- Be sure to keep a log of where you are along the path of remediation for each item or issue in your department that needed remediation. For example: 1) Planned; 2) Drafted, but not implemented; 3) Implemented as a pilot; 4) Implemented, but not sustained, yet; 5) Implemented and sustained and with some examples. Many times, the reviewer will be concerned with the controls that have been implemented, and the evidence of the results of those controls via a few months of execution.
The reviewer’s role: The reviewer’s role is a little more difficult because the reviewer has usually been given a clear objective “to review the area for the entire scope period.” Unless the reviewer has received different instructions by someone in authority, the review needs to include the entire scope period. There are ways to review the entire period without wasting everyone’s time reviewing a lot of “something” that predates the remediation. The reviewer should still review some percentage of items that predate remediation, because a review of these items will help evidence the improvement, but the reviewer should take care to review a greater percent of items from post-remediation.
The reviewer should meet with the department head very early in the planning phase to gain an understanding of which areas or functions in the department have undergone remediation. This meeting is a time to be more specific, rather than less specific. The reviewer has to be able to speak to the enhancements in the department and what impact those enhancements had on the planning of the review.
Documentation: Critical for Success
The critical element in this review process for the reviewer is documentation. A year later when examiners are going over the review, they must be able to follow the logic and reasoning for what was reviewed and from what timeframe.
An example of such documentation could be: “On 4/28/2021 the compliance department implemented an updated Regulation E Debit Card Dispute procedure along with totally revised dispute intake and tracking forms. Later that day, all staff who are involved in the process were retrained. The forms went “live” on 4/29/2021. Prior to the new forms’ being implemented the compliance department reviewed the forms and the associated training and found them to be directionally sound. Therefore, for this review which covers the time period from 1/1/2021 to 6/30/2021 we will select 90% of our samples from 4/29/2021 through 6/30/2021 to test the effectiveness of the enhancements.”
Of course, this documentation becomes significantly more difficult if the forms and training took place on 6/15/2021 because there would be relatively few transactions to test. Assuming the forms and training had already been reviewed, the best course of action in this situation would be to delay the review until there are sufficient transactions to test. Otherwise, the reviewer is going to test transactions that are already known to have errors, and that could be perceived as wasting the time of everyone involved. Consistent with this approach, if a department has many areas or functions that are “in-flight” and new forms (or other controls) were just implemented or not even implemented yet, the reviewer might want to break a bigger review into two sections. The first section of the review would be to review areas that didn’t just undergo remediation. The second section of the review could be delayed a few months to capture all the recently-remediated areas.
Conclusion
In-flight enhancement of controls is quite common in financial institutions, and requires skill and cooperation between the department head and the reviewer, but with some planning, the reviews can have a good outcome.
