sufficient number of qualified and well - trained staff to carry out its responsibilities effectively. policies and procedures policies and procedures essentially define and communicate the key goals and processes of an organization's compliance program. examiners will look to see whether policies and procedures provide for adequate risk identification, assessment, measurement, and control. as i mentioned a few moments ago, clearly communicated roles and responsibilities are a characteristic of an effective compliance program. toward that end, examiners will also look to determine whether policies clearly delineate accountability and lines of authority across the organization's activities. examiners also expect to see a well - defined process for ensuring that when compliance risks or potential breaches are identified they are elevated to the appropriate level, in keeping with the risk to the organization. procedures for doing so should be well - communicated to staff throughout the organization. overall, policies and procedures must be kept current, and, as with the risk assessment, examiners will look to see whether information gleaned from the compliance program operations is used to further tailor compliance policies, procedures, and controls to specifically address the inherent environment as it evolves. internal controls internal controls are a particularly crucial element of a compliance - risk management program. examiners will verify whether the organization has established and implemented an effective system of internal controls, including appropriate reporting lines and separation of duties, as well as positive and negative incentives. an essential part of the internal control framework is periodic testing to determine how well the framework is operating, so that any required remedial actions can be taken. the frequency of testing should be risk - based and should involve, as appropriate, sample transaction testing, the sample size being determined by volume and the degree of risk of the activity. examiners will carefully assess the scope and quality of the testing of the compliance program. part of this assessment will include determining whether the testing was performed with appropriate independence. examiners will also look to understand the specific delineations of responsibilities between the internal audit, compliance, and other independent functions or third parties. these delineations will vary by organization, but all roles should be clearly defined and communicated. examiners will also look at how well compliance - testing exceptions are reported to senior management and resolved by business - line management. they will assess methods for tracking exceptions until the exceptions are resolved ; this assessment will include examining the organization's provisions for escalating unresolved exceptions to higher levels in the organization, including the board of directors. independence and separation of duties

mark w olson : what are examiners looking for when they examine banks for compliance? remarks by mr mark w olson, member of the board of governors of the us federal reserve system, at the american bankers association's regulatory compliance conference, orlando, 12 june 2006. * * * thank you for the invitation to speak today on an issue of great interest to many of us, that is, compliance - risk management and supervisory expectations. over the last few years, legal and regulatory compliance breakdowns have attracted increased attention across the financial industry. fortunately, most of you have responded to your evolving compliance risks by investing in effective compliance - risk management programs. however, now and then, headline - grabbing incidents of noncompliance continue to capture public attention, especially when they involve such sensitive areas as fair lending and the bank secrecy act ( bsa ). conferences such as this are valuable opportunities for you, as compliance experts, to share experiences and successful approaches to controlling compliance risk. to assist you in your efforts to fine - tune your compliance - risk management programs, i'd like to give you a sense of what federal reserve examiners look for when they conduct examinations. i will also take a few minutes to address our more focused work in two particularly important areas of regulatory compliance : compliance with bsa requirements and home mortgage disclosure act ( hmda ) data reporting requirements. otherwise, i will not focus on examinations that look solely at the level of compliance with specific laws and regulations but will focus on how examiners assess the adequacy of a compliance - risk management program and its ability to manage the organization's compliance risk. compliance - risk management overall, a banking organization's compliance - risk management program should enable it to adequately identify, measure, monitor, and control the compliance risks involved in its various products and lines of business. these are fundamental principles not only for compliance - risk management, but also for sound management of credit, market, liquidity, and operational risk. it's worth taking a moment to define compliance risk. it is the risk of legal or regulatory sanctions, financial loss, or damage to reputation and franchise value that may arise when an organization fails to comply with laws, regulations, or standards or codes of conduct of self - regulatory organizations applicable to the business activities and functions of the banking organization. while all banking organizations should have a program in place to effectively manage compliance risk, these programs can vary considerably, depending on the size, complexity, and geographic reach