Bank Regulatory Exam Preparation: What Examiners Are Looking For
6/18/2026
Examination outcomes are determined largely before the examiners arrive. The on-site period reveals the institution's condition; it rarely changes it. What preparation controls is whether the condition is presented accurately and whether the institution appears to understand its own weaknesses.
That second point is the one most institutions underestimate. Examiners distinguish sharply between a bank with a problem it has identified and is fixing, and a bank with the same problem it has not noticed.
What Actually Gets Assessed
Supervisory ratings cover capital adequacy, asset quality, management, earnings, liquidity, and sensitivity to market risk, with consumer compliance and CRA assessed separately.
The management component is the one that quietly drives the others. An institution with a weak asset quality trend and demonstrably strong management oversight — identified early, reported to the board, remediation underway — is assessed differently from one with the same trend and no evidence anyone noticed. Ratings reflect trajectory and governance, not only current numbers.
The Request List
The first-day letter or request list arrives weeks in advance, and how it is handled sets the tone.
Assign a single coordinator. Every item gets an owner and a due date, and everything goes out through the coordinator. Institutions where examiners receive materials from six people get inconsistent information, and inconsistency invites more testing.
Read each item literally, then supply exactly that. Not less, and importantly not more. Volunteering adjacent material expands scope, and it is the most common self-inflicted wound in an examination.
Review before producing. Read what you are about to hand over. If a policy references a control that was discontinued, or a report shows an aged exception population nobody addressed, you want to know before the examiner does — and you want to be ready with what is being done about it.
Flag known issues affirmatively. Where the institution has already identified a weakness, say so, with the remediation plan and dates. This converts a finding into evidence of functioning oversight.
What Examiners Test, by Area
Credit. Loan file sampling for underwriting quality, documentation, risk rating accuracy, and policy exceptions. The allowance methodology and its support. Concentration levels and their management. Loan review independence and scope.
BSA/AML. The program's five pillars individually, the risk assessment and whether the controls reconcile to it, alert handling and aging, SAR timeliness from initial detection, CTR accuracy and exemption reviews, and training records including the board's.
Consumer compliance. The compliance management system as a whole, transaction testing in higher-risk areas, complaint handling and root cause analysis, and fair lending analysis of the institution's own data.
Information security. Board oversight and reporting, risk assessment, access reviews, incident response testing, vendor due diligence, and — the recurring finding — whether any of it can be evidenced.
Governance. Board minutes showing genuine challenge rather than ratification, the currency of policies, the independence of audit, and the status of prior findings.
The Recurring Finding
Across every area, the most common criticism is the same: the program is documented but not evidenced.
Policies exist. Procedures exist. Nobody can produce a record showing that the access review was performed, that the incident response plan was tested, that the exemption was reviewed, that the training was delivered to the board, or that the monitoring alert was dispositioned with a reason.
The corollary is that a great deal of examination preparation is not remediation at all — it is assembling proof of work that was actually done and never recorded. Institutions that maintain the evidence contemporaneously spend the preparation period reviewing rather than reconstructing.
Managing the On-Site Period
Give examiners a working space that is functional and not in the middle of the operation.
Route questions through the coordinator, and log every question and every answer. The log prevents inconsistent responses and creates a record of what was represented.
Answer precisely. Respond to the question asked. Do not speculate, do not fill silence, and do not guess at an answer you can confirm in an hour. "I'll get you that by this afternoon" is always better than an approximation that turns out to be wrong.
Concede what is true. Arguing a defensible finding damages credibility that is needed for the findings genuinely worth contesting.
Escalate surprises immediately. If an examiner raises something management did not know, that is information the institution needs the same day, not at the exit meeting.
Prepare the people being interviewed. Not with scripts, but by ensuring the BSA officer can explain the risk assessment, the information security officer can describe the access review process, and the chief lender can discuss the concentration position. An officer who cannot explain their own program is itself a finding.
Findings and Response
Findings range from recommendations through matters requiring attention to formal enforcement.
The response should identify a root cause rather than a symptom, name an accountable individual, set a realistic date, and describe how completion will be validated. A response promising to "provide additional training" for a control that failed because nobody owned it will not survive the next examination.
Repeat findings are the serious category. Regulators treat the recurrence of a previously identified issue as a governance failure rather than a process failure, and it is the fastest path from informal criticism to a formal action. Any prior finding still open when examiners return should have a documented explanation for why.
What Predicts a Good Outcome
Institutions that examine well share a small number of characteristics, and none of them are about the examination.
They find their own problems. Internal audit, compliance monitoring, and self-assessment surface issues before examiners do, and there is a record of it.
They report bad news upward. Board packages contain the aged exception report and the alert backlog, not only the favorable metrics.
Their remediation actually completes. Findings from the prior cycle are closed, with evidence, rather than carried.
Their people can explain their own programs without reading from a binder.
They keep evidence as a habit rather than assembling it under deadline.
None of that can be manufactured in the six weeks before an examination — which is exactly why the outcome is largely determined beforehand.
Structured coverage is available across our bank compliance training, the Certificate in Compliance Management System (CMS), and Writing Clear and Objective Audit Reports.
The Relationship Between Examinations
Institutions tend to think of examinations as discrete events, and supervisors do not. The examination is a periodic sample of a continuous supervisory relationship that includes off-site monitoring of Call Report data, review of correspondence, and whatever the institution has reported between visits.
Two practical consequences.
Between-examination communication matters. An institution that notifies its regulator promptly of a significant event — a material loss, a system conversion problem, a senior departure, a discovered compliance failure — is treated differently from one whose regulator learns about it at the next examination. The notification is rarely welcomed, and it is consistently better than the alternative.
Consistency is tracked. Representations made in one examination are checked against what is found in the next. An institution that described a control as operating, when it was not, has created a credibility problem far more damaging than the original weakness. This is the practical reason precision matters more than presentation when answering examiner questions.
The framing worth adopting internally: the examination is not an adversarial event to be survived, nor is it a collaborative exercise. It is an assessment by people with statutory authority who will form a view about whether this institution's management knows what is happening inside it. Everything about preparation follows from making that view accurate.
Preparing People, Not Just Documents
Examination preparation focuses almost entirely on assembling materials, and the interviews are frequently where impressions are actually formed. Examiners spend a meaningful portion of their time talking to people, and what they are assessing is whether the person responsible for a program understands it.
Four preparations worth making.
Each program owner should be able to explain their own program without notes. The BSA officer describing the risk assessment and how monitoring reflects it; the information security officer describing the access review cycle and the last incident response test; the chief lender describing the concentration position and how it is managed. Reading from a binder signals that the document was written by someone else or for someone else.
Everyone should know what they do not know. "I don't have that figure in front of me, I'll confirm and send it this afternoon" is a completely acceptable answer and considerably better than a wrong one. Staff who feel they must have every answer immediately are the ones who guess.
Front-line staff should be told what to expect. Examiners talk to tellers and new account representatives, and the questions are usually about ordinary procedure — what do you do when a customer wants to cash a large check, how do you handle a hold, what happens if something seems suspicious. Staff who have been warned that this may happen answer naturally. Staff who are surprised sound evasive when they are merely nervous.
Nobody should be coached to conceal. Beyond the obvious ethical problem, examiners are experienced at detecting rehearsed inconsistency, and an institution caught managing its answers converts a routine examination into a scoped investigation of what else was managed.
The underlying point is that examiners are forming a judgment about management quality, and management quality is visible in whether the people running programs actually understand them. That cannot be assembled in the week before arrival.
A final word on the exit meeting. It is the institution's last opportunity to correct a factual misunderstanding before findings are written, and institutions routinely waste it by treating it as a formality to absorb quietly. If an examiner describes a control inaccurately, or has drawn a conclusion from an incomplete set of documents, that is the moment to say so — politely, specifically, and with the missing evidence in hand. Findings written on a factual error are considerably harder to unwind afterward than they are to prevent in the room, and examiners generally prefer to be corrected before the report is drafted rather than after.
Frequently Asked Questions
What do examiners assess in a bank examination?
Capital adequacy, asset quality, management, earnings, liquidity, and sensitivity to market risk, with consumer compliance and CRA rated separately. The management component quietly influences the others — an institution with a weakness it identified and is remediating is assessed differently from one with the same weakness and no evidence anyone noticed.
How should the examination request list be handled?
Assign one coordinator through whom everything flows, give every item an owner and a due date, read each request literally and supply exactly that, and review materials before producing them. Volunteering adjacent material expands scope and is the most common self-inflicted wound in an examination.
What is the most common examination finding?
That the program is documented but not evidenced. Policies and procedures exist, but there is no record showing the access review was performed, the incident response plan tested, the CTR exemption reviewed, board training delivered, or the monitoring alert dispositioned with a reason. Much of examination preparation is assembling proof of work that was done and never recorded.
How serious is a repeat finding?
Considerably more serious than a new one. Regulators treat recurrence of a previously identified issue as a governance failure rather than a process failure, and it is the fastest route from informal criticism to a formal enforcement action. Any prior finding still open at the next examination needs a documented explanation.
How should staff answer examiner questions?
Precisely and only what was asked. Do not speculate, do not fill silence, and do not guess where the answer can be confirmed. Route questions through the coordinator and log every question and answer to prevent inconsistent responses. Conceding a defensible finding preserves credibility for the findings genuinely worth contesting.
Should a bank tell its regulator about a problem between examinations?
Generally yes. Notifying promptly of a material loss, a failed system conversion, a senior departure, or a discovered compliance failure is treated very differently from having the regulator find it at the next examination. Supervision is a continuous relationship, and representations made in one examination are checked against what is found in the next.
