By Michael Althouse, CRCM, and Mandi Lermond
One of the most important skills necessary to navigate audits and regulatory exams has always been communication. But what happens when you experience a global pandemic (or other event) that forces every aspect of the audit or exam process to be completely virtual? Not surprisingly, communication skills both internally—and with your examiners—become even more important.In the pre-pandemic world, you could break the exam process into three basic parts—pre-exam preparation, day-to-day management, and post-exam wrap-up. These stages don’t really change in a virtual environment, but some of the critical tools and behaviors needed during them absolutely do.
We found that the running theme throughout our recent all-virtual exam experience kept returning to one simple question—howgozit?
If you’re unfamiliar with flying an aircraft, “howgozit?” is basically a graph that shows distance covered, fuel consumed, and time elapsed, so the pilot knows how a flight is proceeding along its route. It was quite important to consult the “howgozit?” graph when conducting trans-oceanic flights, since fuel consumption and the point of no return can determine whether you should continue to your destination. However, it’s also a great phrase to keep in mind when navigating this “new normal” of virtual audits and exams. It is the one question you should ask over and over, both with internal stakeholders and your colleagues on the audit or exam teams. Given the inability to meet in person, it’s honestly a question you should over-ask in order to avoid small issues blowing up overnight.
Pre-exam preparation
The pre-exam preparation phase becomes even more important during a virtual exam, as your level of preparedness will dictate how smoothly the actual review will go, and how long it might take. During the prep stage, you should identify the key subject matter experts that need to be available to meet with the examiners to explain their processes and controls. Considering the exam will be virtual—you may need to include key IT staff to discuss the implications of delivering all exam materials electronically.
It is during the prep phase that you should also build a library of materials about your bank—process workflows, new products, key changes since your last exam, etc. Be sure to include information on how your key risk management functions have been adapted to ensure business-as-usual functionality during the pandemic. While these materials can be jokingly referred to as “marketing,” you really should highlight the good things your bank has done in the spirit of risk management. We found one presentation that worked quite well was an overview of the bank and its lines of business for Day 1—essentially a “Your Bank 101” course. If your staff asks if they should show the examiners background information about how they developed X, Y or Z, the answer should always be “yes.” As a general rule, you should have more materials available to explain your businesses and how you developed your risk management controls, than you think are necessary. The more context, the better. Because if you don’t have it, the examiners will likely ask for it anyway and you’ll suddenly find yourself in a reactive mode. This is a tip that is particularly useful in a post-pandemic environment as well, as it just makes the exam run more efficiently.
You should also set up a regular cadence of meetings with your team of internal stakeholders. During these meetings, “howgozit?” applies to their deliverables. Are they ready? If not, when will they be ready? Are the stakeholders prepared to meet with auditors or examiners? What do they need to get there? Do we have the right people slated to be in the (virtual) room?
You also need to discuss logistics with your audit or exam team. Is technology compatible between the two entities? Which video conferencing platform will be used? How will documents be shared with examiners? The pandemic has made it nearly impossible to share hard copies of documents so how will those be reviewed? Do they need to be scanned? These questions and more must be addressed before the exam starts to avoid any roadblocks or delays.
At the end of the pre-exam preparation, you should also have most of the expected Day 1 request list at the ready, along with who will speak to these items if necessary.
Day-to-day exam management
Day-to-Day exam management is obviously the most critical phase and will be the litmus test of your communication skills. In a pre-pandemic world, it was fairly easy to communicate with regulators. Most banks put their examiners in a conference room or area of the floor where they could be easily contained, right? Then a compliance officer could just “drop by” and see if they had questions or get a status update, or ask the really important question—“When did you say you’d be finished again?”
So, what do you do when you can’t put a bunch of people into a room safely? You create one—a virtual one.
We found that once we set up regular meetings to discuss emerging questions, we eventually saw fewer request lists, which resulted in less internal work chasing down deliverables with our business partners. But it wasn’t just about getting people on the phone; video conferencing was a must.
During an exam—especially during a pandemic—it’s so important to be able to put faces to names but also to read body language. It has been reported that upwards of 70 to 80 percent of communication is non-verbal. On video, you can tell if your message is being received or not. You can tell if what you thought was a cogent explanation really did make sense. And, honestly, you can humanize the whole process. The examiners have a job to do just like the bank does, and it can be easy to forget that if all your interactions are audio-only.
Setting up video communication can be an unexpected challenge, though. It is important to understand what potential technology restrictions your examiners may have. For example, our regulators use a videoconferencing tool that our bank’s IT department blocks. Our exam team also received guidance that they were not allowed to use other video conferencing tools, which created a bit of an impasse. Communication, though, helped solve the problem. Each side laid out their facts, and we were able to determine that as long as our examiners did not present their information onscreen, our video conferencing system could be used. We had to ask the question though, and have it answered to uncover that information.
This anecdote brings up another suggestion for the day-to-day phase—you need to ask your auditors and examiners more questions than you will probably feel comfortable asking, such as:
- Does this process make sense?
- What else do you need on this topic?
- Would another meeting help?
- What concerns do you have that we have not addressed?
- About which aspects are you still unclear?
You need to flip the script and ask them questions, and you may need to ask questions beyond the point where it feels uncomfortable to be doing so. The same goal of being able to ask your examiners “howgozit?” applies in the virtual world as it did when everything was in person. But when engaging virtually, be prepared to probe a bit more forcefully than it felt like you did in your previous in-person exam. It’s important to proactively confirm that all lingering issues or emerging concerns raised by the exam team are identified as early as possible.
There is also an internal day-to-day exam management aspect that is made more difficult by doing everything virtually. No longer can you just go stand by a co-worker’s desk, tap your foot, and ask how their deliverable is coming. You need to set up regular internal video meetings with internal stakeholders, just like you did with your audit or exam teams to find out “howgozit?” with those request responses. You should also expect longer lead times for those items, especially if you have teams in multiple time zones.
Post-exam
The test of your communication skills does not end with the fieldwork. We recommend keeping at least a weekly meeting with your exam team to ask, “howgozit?” How is the report coming? Did any new questions come to mind as you were writing your observations? Do you have any emerging concerns we can address or are there one-off meetings we need to set up to review a process again? You need to ask more questions of your audit or exam team than you answer in order to make sure there are no surprises when the report is finally issued. Communication must also occur with and at different levels of management. Senior leaders from the bank’s management team should meet and communicate regularly with corresponding senior leaders on your audit or regulatory teams. You can’t rely on upward communication traveling to the top, so force it to happen.
Another good practice is to conduct an internal “lessons learned” session so you can refine your exam or audit management plan. What worked well? What didn’t go as planned? What obstacles could have been avoided? These lessons should be documented and shared within your internal exam management team and should be reviewed in the next pre-exam preparation process. As they say, those who cannot learn from history are condemned to repeat it, and no one likes to see the word “repeat” in an exam or audit context!
These suggestions should help you manage your next exam or audit, which will likely have a heavy virtual component. While every exam or audit can be the ultimate test of a compliance officer’s communication skills, those traits will be put to an even stricter test in a completely virtual exam. In order to be as successful as you can, you should try to replicate the in-person environment as much as possible. Video conferencing and uncomfortably frequent check-ins can help you keep track of exam progress and potential emerging concerns. When in doubt, ask the question. Even if you think you know the answer, ask the question anyway. And always, always remember to check “howgozit?”
Michael Althouse, CRCM, is chief compliance officer at the Bancorp Bank, the top U.S. prepaid card issuer in the United States, and a former U.S. Navy pilot. Mandi Lermond, is chief of staff for the COO at the Bancorp Bank, leading regulatory remediation projects primarily related to BSA/AML and leading the Bancorp’s exam management process.
