Exhibit 109 — In re Bank of America California Unemployment Benefits Litigation (Dkt. 350-110, S.D. Cal. No. 3:21-md-02992)

Record facts

U.S. District Court for the Southern District of California · No. 3:21-md-02992-GPC-MSB · Doc. 350-110 · 2024-10-24 · Docket on CourtListener

Full text

EXHIBIT 109 
Case 3:21-md-02992-GPC-MSB     Document 350-110     Filed 10/24/24     PageID.11977 
Page 1 of 23

Comptroller’s Handbook
Examination Process
Large Bank Supervision
Version 1.0, June 2018
Version 1.1, September 2019 
Version 1.2, March 2022
Case 3:21-md-02992-GPC-MSB     Document 350-110     Filed 10/24/24     PageID.11978 
Page 2 of 23

Version 1.2 
Comptroller’s Handbook 
8 
Large Bank Supervision 
Risk-Based Supervision Approach 
 
Related “Bank Supervision Process” Booklet Sections 
● “Introduction” > “Bank Affiliates and Related Organizations” 
● “Examination Authority and Full-Scope, On-Site Examination Requirement” 
● “Risk-Based Supervision Approach” 
● Appendix A, “Functional Regulation” 
 
From a supervisory perspective, risk is the potential that events will have an adverse effect on 
the bank’s current or projected financial condition16 and resilience.17 In carrying out its 
mission, the OCC employs an ongoing risk-based supervision approach focused on 
evaluating risk, identifying material and emerging concerns, and requiring banks to take 
timely corrective action before deficiencies compromise their safety and soundness. 
Examiners evaluate risk using the RAS and tailor supervisory activities to the risks identified. 
 
The OCC recognizes that banking is a business of assuming risks to earn profits. Midsize and 
large banks assume varied risks that may be complex. The foundation of midsize and large 
bank supervision is a risk assessment framework designed to determine whether banks 
effectively assess risks throughout their entire enterprise, including subsidiaries and affiliates. 
Under the risk-based supervision approach, examiners focus on whether banks identify and 
effectively manage the risks they assume. As a bank grows more diverse and complex, its 
risk management processes should keep pace. When risk is not properly managed, the OCC 
directs bank management to take corrective action. In all cases, the OCC’s primary concern 
is that the bank operates in a safe and sound manner and maintains capital commensurate 
with its risk. (Updated in version 1.2) 
 
To fully implement the risk-based supervision approach, examiners assess the risk profiles 
and assign regulatory ratings to the lead OCC-supervised bank and its affiliated OCC-
supervised banks. Examiners may determine that risks in individual OCC-supervised banks 
are increased, reduced, or mitigated in light of the consolidated risk profile of the company as 
a whole. To perform a consolidated analysis, examiners should obtain pertinent information 
from banks and affiliates (refer to the “Functional Regulation” section of the “Bank 
Supervision Process” booklet), assess risk to the OCC-supervised banks resulting from 
activities conducted by the bank’s affiliates, and obtain information from other regulatory 
agencies, as necessary. Figure 1 illustrates the OCC’s risk-based supervision approach. The 
sections that follow explain the relationship between each of the concepts illustrated in figure 
1. Later in this booklet, the “Supervisory Process” section explains how each of these 
components is incorporated into the OCC’s supervisory process. 
 
 
16 Financial condition includes impacts from diminished capital and liquidity. Capital in this context includes 
potential impacts from losses, reduced earnings, and market value of equity. 
 
17 Resilience recognizes the bank’s ability to withstand periods of stress. 
Case 3:21-md-02992-GPC-MSB     Document 350-110     Filed 10/24/24     PageID.11979 
Page 3 of 23

Version 1.2 
Comptroller’s Handbook 
9 
Large Bank Supervision 
Figure 1: Risk-Based Supervision Components 
 
 
 
Core Knowledge 
 
Core knowledge is information in the OCC’s supervisory information systems about the 
bank, its culture, risk profile, and other internal and external factors. This information 
enables examiners to communicate critical data to each other with greater consistency and 
efficiency. 
 
Core Assessment Overview 
 
(Section updated in version 1.2) 
 
Related “Bank Supervision Process” Booklet Section 
● “Risk-Based Supervision Approach” > “Core Assessment” 
 
Core assessment establishes the minimum conclusions examiners must reach to assess risk 
and assign regulatory ratings. Examiners must reach these conclusions during the course of 
each supervisory cycle as part of meeting the requirements of the mandatory full-scope, on-
site examination. Examiners complete one consolidated core assessment summary for all 
OCC-supervised banks within a company during every supervisory cycle. The core 
assessment summary (or portions thereof) may be performed more often when the EIC or 
supervisory office deems appropriate. Regulatory ratings must be assigned at least annually 
for each OCC-supervised bank in the company. The core assessment’s standards are 
sufficiently flexible to be applied to all banks; examiners can use the standards to assess risks 
for all product lines and legal entities. The structure of the core assessment facilitates the 
analysis of risk in merging banks because examiners use a common language and the same 
standards to assess risks. 
Case 3:21-md-02992-GPC-MSB     Document 350-110     Filed 10/24/24     PageID.11980 
Page 4 of 23

Version 1.2 
Comptroller’s Handbook 
10 
Large Bank Supervision 
Examiners should use judgment in deciding how to perform the core assessment, including 
the level of transaction testing needed to reach conclusions. Examiners should be alert to 
specific activities or risks that may trigger the need to expand the scope of the supervisory 
activity, which can include expanded procedures from other Comptroller’s Handbook 
booklets. A decision to modify an activity’s scope should be escalated consistent with OCC 
processes and documented in the appropriate OCC supervisory information system. 
 
Ongoing Supervision 
 
(Section added in version 1.2) 
 
Ongoing supervision is the OCC’s process for assessing risks and reviewing core knowledge 
about a bank on an ongoing basis. It is a key component of the OCC’s risk-based supervision 
approach. Examiners conduct periodic monitoring through ongoing supervision and target 
examinations to determine if any changes to regulatory ratings and RAS conclusions are 
warranted. Examiners prepare a quarterly supervision update to document the results of 
ongoing supervision each quarter. A quarterly supervision update is not prepared for quarters 
in the supervisory cycle during which the core assessment is documented.18 
 
On a quarterly basis, and generally within 55 days after the end of each quarter, 
examiners should 
 
• review and evaluate the consolidated financial statements for the bank and significant 
operating units. 
• identify any significant issues that may result in changes to risk assessments and adjust 
the supervisory strategy to reflect the change, if warranted. If an issue is identified that 
affects a CAMELS/ITCC rating for the lead OCC-supervised bank and any affiliated 
OCC-supervised banks, the examiner must update the rating and communicate the rating 
change to the bank in writing. A CRA evaluation must be performed to change a CRA 
rating. 
• update the consolidated risk profile of OCC-supervised banks within the organization 
using the RAS. One of these quarterly assessments results in documentation of the core 
assessment summary and includes a comprehensive narrative on the aggregate risk, 
direction of risk, quantity of risk, and quality of risk management for each risk category. 
The three remaining quarterly assessments are quarterly supervision updates that 
document changes in the bank’s risk profile. 
• review and update the supervisory strategy and data in the OCC’s supervisory 
information systems to ensure they are current and accurate. The EIC should change the 
strategies for individual banks, if warranted. Examiners should discuss any significant 
changes with bank management and obtain approval from their supervisory office. 
 
 
18 For more information about the core assessment, refer to the “Core Assessment” section of this booklet. 
(Footnote added in version 1.2) 
Case 3:21-md-02992-GPC-MSB     Document 350-110     Filed 10/24/24     PageID.11981 
Page 5 of 23

Version 1.2 
Comptroller’s Handbook 
11 
Large Bank Supervision 
Expanded and Verification Procedures 
 
Related “Bank Supervision Process” Booklet Sections 
● “Risk-Based Supervision Approach” 
> “Expanded Procedures” 
> “Verification Procedures” 
 
Expanded procedures contain detailed guidance for examining specialized activities or 
products that warrant extra review beyond the core assessment. These procedures are found 
in other booklets of the Comptroller’s Handbook, the FFIEC BSA/AML Examination 
Manual, and the FFIEC IT Examination Handbook, or are conveyed separately in an OCC 
bulletin. Examiners determine which expanded procedures to use, if any, during examination 
planning or after drawing preliminary conclusions during the core assessment. 
 
Verification procedures are designed to guide verification of the existence or proper 
recordation of assets or liabilities, or to test the reliability of financial records. These 
procedures can be found in most booklets in the Safety and Soundness and Asset 
Management series of the Comptroller’s Handbook. Refer to the “Bank Supervision Process” 
booklet for information regarding use of verification procedures. 
 
Risk Assessment System Overview 
 
(Section title updated in version 1.2) 
 
Related “Bank Supervision Process” Booklet Section 
● “Risk Assessment System” 
 
By completing the core assessment and, as necessary, expanded or verification procedures, 
examiners assess the bank’s risk exposure for the following eight categories of risk using the 
RAS: credit, interest rate, liquidity, price, operational, compliance, strategic, and 
reputation.19 These categories are not mutually exclusive. Risks also may be interdependent 
and may be positively or negatively correlated. 
 
As the primary regulator of federally chartered banks, the OCC has the responsibility for 
evaluating the consolidated risk profile of such banks. The consolidated risk profile is 
developed by combining the assessment of risks at each affiliated federally chartered bank, 
including an assessment of the material risks posed to the banks by the banks’ or any FRA’s 
functionally regulated activities, as appropriate. The relative importance of each risk, both for 
an individual bank and for the federally chartered banks in aggregate, should influence the 
development of the supervisory strategy, the assignment of resources, and the bank’s 
regulatory ratings. (Updated in version 1.2) 
 
 
19 Refer to the “Risk Assessment System” section of this booklet for definitions of each category of risk. 
Case 3:21-md-02992-GPC-MSB     Document 350-110     Filed 10/24/24     PageID.11982 
Page 6 of 23

Version 1.2 
Comptroller’s Handbook 
12 
Large Bank Supervision 
For each of the eight categories of risk, examiners draw conclusions regarding the quantity of 
risk, quality of risk management, aggregate risk, and direction of risk: 
 
• Quantity of risk is the level or volume of risk that the bank faces and is characterized as 
low, moderate, or high. 
• Quality of risk management is how well risks are identified, measured, controlled, and 
monitored and is characterized as strong, satisfactory, insufficient, or weak. 
• Aggregate risk is a summary conclusion about the level of supervisory concern. 
Aggregate risk incorporates assessments about the quantity of risk and the quality of risk 
management. (Examiners weigh the relative importance of each.) Examiners characterize 
aggregate risk as low, moderate, or high. 
• Direction of risk is a prospective assessment of the probable movement in aggregate risk 
over the next 12 months and is characterized as decreasing, stable, or increasing. The 
direction of risk often influences the supervisory strategy, including how much validation 
is needed. If risk is decreasing, the examiner expects, based on current information, 
aggregate risk to decline over the next 12 months. If risk is stable, the examiner expects 
aggregate risk to remain unchanged. If risk is increasing, the examiner expects aggregate 
risk to be higher in 12 months. 
 
The presence of risk is not necessarily reason for concern. Examiners determine whether the 
risks the bank assumes are warranted by assessing whether the risks are effectively managed 
in a manner consistent with safe and sound banking practices. Generally, a risk is effectively 
managed when it is identified, measured, monitored, controlled, and reported. Senior bank 
management should report to the board on the bank’s overall risk profile, including aggregate 
and emerging risks. The bank should have the capacity to readily withstand the financial 
distress that a risk, in isolation or in combination with other risks, could cause. 
 
If examiners determine that a risk is unwarranted (e.g., not effectively managed or supported 
by adequate capital), they must communicate to bank management and the board the need to 
mitigate or eliminate the unwarranted risk. Appropriate actions may include reducing 
exposures, increasing capital, or strengthening risk management practices. 
 
Examiners should discuss RAS conclusions (preliminary and final) with bank management 
and the board during each supervisory cycle. Following preliminary discussions, examiners 
should adjust conclusions when appropriate. Once the risks have been clearly identified and 
communicated, the OCC can then focus its supervision on the areas of greater risk within the 
bank, the consolidated banking company, and the banking system. If a change to the RAS 
occurs that warrants altering the bank’s supervisory strategy or requires corrective action by 
bank management, examiners should formally communicate the rationale for the change to 
bank management or the board and obtain commitments for any required corrective actions. 
These communications help the bank and the OCC reach a common understanding of the 
bank’s risks, focus on the strengths and weaknesses of risk management, and achieve 
supervisory objectives. 
 
Case 3:21-md-02992-GPC-MSB     Document 350-110     Filed 10/24/24     PageID.11983 
Page 7 of 23

Version 1.2 
Comptroller’s Handbook 
13 
Large Bank Supervision 
Risk Management 
 
(Section updated in version 1.2) 
 
A sound risk management system identifies, measures, monitors, and controls risks. Because 
market conditions and company structures vary, no single risk management system works for 
all banks. The sophistication of the risk management system should be commensurate with 
the bank’s size, complexity, and risk profile. As a bank grows more diverse and complex, the 
sophistication of its risk management should keep pace. Regardless of the risk management 
system’s design, each system should identify, measure, monitor, and control risk.20 
 
Banks of $50 billion or more in average total consolidated assets (covered banks) are subject 
to heightened standards as detailed in 12 CFR 30, appendix D. Under these standards, the 
OCC expects covered banks to establish and adhere to a written risk governance framework 
to manage and control their risk-taking activities. Minimum standards are also provided for a 
bank’s board to follow in overseeing the risk governance framework. 
 
Examinations focus on the overall integrity and effectiveness of risk management systems. 
Periodic validation, a vital component of examinations, verifies the integrity of these risk 
management systems. When examiners assess risk management systems, they consider the 
bank’s policies, processes, personnel, and control systems.21 If any of these areas is deficient, 
the bank’s risk management is typically also deficient. 
 
Measuring and Assessing Risk 
 
Examiners obtain both a current and prospective view of the bank’s risk profile and 
determine the bank’s overall condition. When appropriate, this risk profile incorporates the 
potential material risks to the bank from functionally regulated activities conducted by the 
bank or the bank’s FRAs.22 Completing the core assessment provides the conclusions to 
complete the RAS. Together, the core assessment and the RAS enable the OCC to measure 
and assess existing and emerging risks, regardless of the bank’s size or complexity. (Updated 
in version 1.2) 
 
Additionally, the RAS drives supervisory strategies and activities, and it helps examiners 
determine when to require action by bank management to address deficiencies before those 
deficiencies compromise the bank’s safety and soundness. The RAS also facilitates 
discussions with bank management and the board about the bank’s risks. 
 
 
20 For more information about identifying, measuring, monitoring, and controlling risk, refer to the “Corporate 
and Risk Governance” booklet of the Comptroller’s Handbook. (Footnote added in version 1.2) 
 
21 For more information about policies, processes, personnel, and control systems, refer to the “Corporate and 
Risk Governance” booklet of the Comptroller’s Handbook. (Footnote added in version 1.2) 
 
22 Refer to the “Functional Regulation” section of the “Bank Supervision Process” booklet. 
Case 3:21-md-02992-GPC-MSB     Document 350-110     Filed 10/24/24     PageID.11984 
Page 8 of 23

Version 1.2 
Comptroller’s Handbook 
14 
Large Bank Supervision 
Internal Controls and Audit 
 
Related “Bank Supervision Process” Booklet Section (Text box added in version 1.2) 
● “Examination Authority and Full-Scope, On-Site Examination Requirement” > “Assessment of Audit 
Functions” 
 
Examiners evaluate and validate two fundamental components of any bank’s risk 
management system—internal controls and audit—as part of the core assessment. An 
accurate evaluation of internal controls and audit is critical to the proper supervision of the 
bank. Examiners communicate to the bank their overall assessments (strong, satisfactory, 
insufficient, or weak) of the system of internal controls and the audit program, along with 
any significant concerns or weaknesses. Based on these assessments, examiners determine 
the amount of reliance they can place on internal controls and audit for areas under 
examination. Effective bank audit functions may help establish the scopes of current 
supervisory activities and contribute to strategies for future supervisory activities. (Updated 
in version 1.2) 
 
Internal Controls 
 
An effective system of internal controls is the backbone of the bank’s risk management 
system. For banks covered by 12 CFR 363, bank management must assess the effectiveness 
of the bank’s internal control structure annually and the external auditors must attest to bank 
management’s assertions.23 Examiners should obtain an understanding of how the auditors 
reached their conclusions. (Updated in version 1.2) 
 
The core assessment includes factors for assessing the bank’s control environment during 
each supervisory cycle. The factors are consistent with industry-accepted criteria24 for 
establishing and evaluating the effectiveness of internal controls. When examiners need to 
use expanded procedures, they should refer to the “Internal Control” booklet of the 
Comptroller’s Handbook (national banks), OTS Examination Handbook section 340, 
“Internal Control” (FSAs), other appropriate booklets of the Comptroller’s Handbook, the 
FFIEC IT Examination Handbook, and the FFIEC BSA/AML Examination Manual. These 
resources provide more information on the types of internal controls commonly used in 
specific banking functions. 
 
 
23 Banks that are subject to 12 CFR 363 or that file periodic reports under 12 CFR 11 and 12 CFR 16.20 may be 
subject to the provisions of the Sarbanes–Oxley Act. For more information, refer to the “Internal and External 
Audits” booklet of the Comptroller’s Handbook. 
 
24 The Committee of Sponsoring Organizations of the Treadway Commission’s 1992 report “Internal Control–
Integrated Framework” discusses control system structures and components. The committee is a voluntary 
private-sector organization, formed in 1985, dedicated to improving the quality of financial reporting through 
business ethics, effective internal controls, and corporate governance. The committee was jointly sponsored by 
the American Accounting Association, the American Institute of Certified Public Accountants, the Financial 
Executives Institute, the Institute of Internal Auditors, and the National Association of Accountants. 
Case 3:21-md-02992-GPC-MSB     Document 350-110     Filed 10/24/24     PageID.11985 
Page 9 of 23

Version 1.2 
Comptroller’s Handbook 
15 
Large Bank Supervision 
Audit 
 
Related “Bank Supervision Process” Booklet Section 
● “Examination Authority and Full-Scope, On-Site Examination Requirement” > “Assessment of Audit 
Functions” 
 
Assessment of the bank’s audit functions (internal and external) is fundamental to the OCC’s 
overall supervisory process and forms the basis for the OCC’s assessments of internal 
controls. Effective bank audit functions may help establish the scopes of current supervisory 
activities and contribute to strategies for future supervisory activities. 
 
The EIC should tailor the audit review to fit examination objectives. When doing so, he or 
she should consider the bank’s size, complexity, scope of activities, and risk profile. 
Examiners responsible for audit reviews, through coordination with functional and specialty 
area examiners, should determine how much reliance the OCC can place on audit work. OCC 
examiners assess the bank’s overall audit function during each supervisory cycle by 
 
• drawing a conclusion about the adequacy and effectiveness of the overall audit program 
and the board’s oversight of the audit program. 
• assigning a rating to the overall audit program (strong, satisfactory, insufficient, weak). 
 
Midsize and large bank examiners should begin with the minimum audit standards from the 
“Core Assessment” section of this booklet and tailor their review of audit to fit their 
objectives and needs. Examiners should take into consideration audit assessments in other 
target examinations, along with ongoing supervision activities, when completing the audit 
core assessment. As part of the audit reviews, examiners may need to perform expanded 
procedures from the “Internal and External Audits” booklet to assess the audit function. 
 
The review of internal audit work papers, including those from outsourced internal audit, 
may not be waived during any supervisory cycle. The EIC has flexibility, however, in 
limiting the scope of the work paper reviews (i.e., the number of internal audit programs or 
work papers reviewed) based on his or her familiarity with the bank’s audit function and 
findings from the previous review of internal audit. Examiners typically do not review 
external audit work papers25 unless the review of the internal audit function discloses 
significant issues (e.g., insufficient audit coverage) or questions are raised about matters 
normally within the scope of an external audit program. 
 
Examiners may identify significant audit or control discrepancies or weaknesses, or may 
raise questions about the audit function’s effectiveness after completing the core assessment. 
In those situations, examiners should consider expanding the scope of the review by selecting 
expanded procedures in the “Internal and External Audits” or “Internal Control” booklets of 
the Comptroller’s Handbook (national banks); OTS Examination Handbook section 340, 
 
25 Before reviewing external auditor work papers, examiners should meet with bank management and the 
external auditor, consult with the OCC’s chief accountant, and obtain approval from the supervisory office. 
Case 3:21-md-02992-GPC-MSB     Document 350-110     Filed 10/24/24     PageID.11986 
Page 10 of 23

Version 1.2 
Comptroller’s Handbook 
16 
Large Bank Supervision 
“Internal Control” (FSAs); or other appropriate booklets of the Comptroller’s Handbook, the 
FFIEC IT Examination Handbook, or the FFIEC BSA/AML Examination Manual. 
 
When reviewing the audit function, significant concerns may remain about the adequacy or 
independence of an audit or about the integrity of the bank’s financial or risk management 
controls. If so, examiners should consider further expanding the audit review to include 
verification procedures. Even when the external auditor issues an unqualified opinion, 
verification procedures should be considered if discrepancies or weaknesses call into 
question the accuracy of the opinion. The extent to which examiners perform verification 
procedures is decided on a case-by-case basis after consultation with the supervisory office.26 
 
Direct confirmation27 with the bank’s customers must have prior approval of the appropriate 
deputy comptroller. Examiners should notify OCC legal counsel when the OCC is 
considering direct confirmations. (Updated in version 1.2) 
 
If examiners identify significant audit weaknesses, the EIC should recommend to the 
appropriate supervisory office what action the OCC should take to require the bank to correct 
the weaknesses. Consideration should be given to whether the bank complies with the laws 
and regulations28 that establish minimum requirements for internal and external audit 
programs. Further, if the bank does not meet the audit system operational and managerial 
standards of 12 CFR 30, appendix A, possible options to consider are having bank 
management develop a compliance plan, consistent with 12 CFR 30, to address the 
weaknesses, or making the bank subject to other types of enforcement actions. In making a 
decision, the supervisory office considers the significance of the weaknesses, the overall 
audit assessment, audit-related matters requiring attention (MRA), bank management’s 
ability and commitment to effect corrective action, and the risks posed to the bank. 
 
For more information, refer to the “Bank Supervision Process” and “Internal and External 
Audits” booklets of the Comptroller’s Handbook. 
 
12 CFR 363 Annual Report Review 
 
Examiners review annual reports for banks covered by 12 CFR 363 or voluntary submitters 
of such reports.29 The primary purpose of this review is to facilitate the early identification of 
problems in financial management of these banks. Examiners should conduct a review of the 
 
26 Internal control questionnaires and verification procedures can be found in certain booklets of the 
Comptroller’s Handbook. 
 
27 Direct confirmation involves the OCC confirming the accuracy of bank records directly with a bank 
customer. Direct confirmations are rare. (Footnote added in version 1.2) 
 
28 For more information on the laws, regulations, and policy guidance relating to internal and external audit 
programs, refer to appendix A of the “Internal and External Audits” booklet of the Comptroller’s Handbook. 
 
29 The requirements are applicable to insured banks with $500 million or more in total assets. Uninsured banks 
and banks below this asset threshold may choose to voluntarily comply with some or all of 12 CFR 363’s 
requirements. (Footnote updated in version 1.2) 
Case 3:21-md-02992-GPC-MSB     Document 350-110     Filed 10/24/24     PageID.11987 
Page 11 of 23

Version 1.2 
Comptroller’s Handbook 
17 
Large Bank Supervision 
12 CFR 363 annual reports as part of the next ongoing supervision activity or target 
examination, no later than the quarter following the bank’s submission. Results of this review 
should be used in the supervisory process, for example, in examination planning, supervisory 
strategy considerations, subsequent examinations, and discussions with bank management, as 
appropriate. Examiners should promptly advise the supervisory office of any qualified or 
adverse opinion or disclaimer of opinion encountered. For more information, refer to 
appendix C, “12 CFR 363 Reporting,” of the “Internal and External Audits” booklet of the 
Comptroller’s Handbook. (Updated in version 1.2) 
 
Supervisory Process 
 
Related “Bank Supervision Process” Booklet Section 
● “Risk-Based Supervision Approach” > “Supervisory Process” 
 
The OCC fulfills its mission principally by supervising banks on an ongoing basis. In 
midsize and large banks, supervisory activities occur throughout the supervisory cycle. The 
supervisory process includes planning, supervisory activities, communication, and 
documentation as illustrated in figure 2. The elements of the OCC’s risk-based supervision 
approach discussed earlier in this booklet are integrated throughout the supervisory process. 
 
Figure 2: Supervisory Process 
 
 
Case 3:21-md-02992-GPC-MSB     Document 350-110     Filed 10/24/24     PageID.11988 
Page 12 of 23

Version 1.2 
Comptroller’s Handbook 
18 
Large Bank Supervision 
Planning 
 
Related “Bank Supervision Process” Booklet Section 
● “Risk-Based Supervision Approach” > “Supervisory Process” > “Planning” 
 
Planning is essential to effective supervision and occurs throughout the bank’s supervisory 
cycle. Planning requires careful and thoughtful assessment of the bank’s current and 
anticipated risks (e.g., examiners should assess the risks of both existing and new banking 
activities).30 Planning includes 
 
• developing and maintaining a supervisory strategy for each bank. (Supervisory strategies 
for OCC-supervised banks are generally documented as one strategy for all OCC-
supervised banks within a multibank organization.) (Updated in version 1.2) 
• examination planning that occurs before starting a supervisory activity. 
• coordinating with other regulators, as appropriate. 
 
Supervisory Strategy 
 
Related “Bank Supervision Process” Booklet Sections 
● “Risk-Based Supervision Approach” > “Supervisory Process” > “Planning” > “Supervisory Strategy” 
● “Examination Authority and Full-Scope Examination Requirement” > “Specialty Area Considerations” 
 
The supervisory strategy is the OCC’s detailed supervisory plan for the bank and outlines 
supervisory objectives, supervisory activities, and work plans. The supervisory strategy 
integrates all supervisory activities planned for the supervisory cycle and quantifies the 
necessary examiner resources (e.g., workdays and experience level) to complete the 
identified activities. 
 
Supervisory strategies for OCC-supervised banks (e.g., within a multibank organization) are 
generally documented as one strategy for all OCC-supervised banks within the organization. 
If necessary, consolidated strategies can be supplemented by plans specific to one or more 
affiliates. The EIC develops the supervisory strategy with input from the resident examiners 
or functional EICs, as appropriate. For large banks, the appropriate deputy comptroller 
reviews and approves each strategy. For midsize banks, the appropriate assistant deputy 
comptroller approves the strategy. Examiners document strategies in the appropriate OCC 
supervisory information system. (Updated in version 1.2) 
 
Each supervisory strategy includes supervisory objectives, supervisory activities, and work 
plans, and is based on 
 
• core knowledge, core assessment, RAS, regulatory ratings, and the supervisory history of 
the bank. 
 
30 Refer to OCC Bulletin 2017-43, “New, Modified, or Expanded Bank Products and Services: Risk 
Management Principles.” 
Case 3:21-md-02992-GPC-MSB     Document 350-110     Filed 10/24/24     PageID.11989 
Page 13 of 23

Version 1.2 
Comptroller’s Handbook 
19 
Large Bank Supervision 
• statutory examination requirements. 
• the OCC’s annual bank supervision operating plan.31 
• supervisory priorities of the agency. 
• economic conditions. 
• banking industry trends. 
• other examination guidelines (e.g., expanded procedures in the Comptroller’s Handbook, 
FFIEC IT Examination Handbook, or FFIEC BSA/AML Examination Manual). 
 
The supervisory strategy should also incorporate an assessment of the company’s merger and 
acquisition plans and any conditions attached to corporate decisions. 
Supervisory objectives define the goals of supervision for the specific bank, based on its 
risk profile, and are the foundation for all activities and work plans. Strategies may optionally 
include an overview of the profiles of the bank’s significant lines of business to support the 
supervisory objectives. 
 
Supervisory activities are the means of achieving supervisory objectives. Each activity must 
be linked to at least one objective. Supervisory activities must be sufficient, in aggregate, to 
meet the definition of a full-scope, on-site examination.32 The strategy should identify the 
supervisory activities recommended for each quarter of the supervisory cycle. This 
information is often consolidated by each RAS category and then modified to address the 
bank’s specific risk profile, including areas of potential or actual risk, emerging risks, and 
regulatory mandated examination areas. (Updated in version 1.2) 
 
Work plans outline the scope, timing, and resources needed to meet the supervisory 
objectives and activities. Work plans should 
 
• identify the complexity, workdays, and expertise of staff needed to perform the bank 
supervisory activities recommended for the year. 
• include a preliminary budget projection of the work to be completed, including any 
international travel. 
 
Work plans may also include an internal and external communications strategy for the year. 
This communications strategy may detail the types of information examiners exchange with 
boards, bank management, bank personnel, and other regulators and describes how this 
information is to be exchanged (i.e., meetings and reports). 
 
Supervisory strategies are dynamic. Strategies are reviewed and updated on an ongoing basis 
based on company, industry, economic, legislative, and regulatory developments. Examiners 
should follow established procedures for receiving approval for and documenting strategy 
changes. Examiners should discuss supervisory strategies with bank management as the plans 
are made and when any of the plans are modified. 
 
31 The OCC’s Committee on Bank Supervision issues an annual bank supervision operating plan that sets forth 
the OCC’s supervision priorities and objectives. 
 
32 Refer to the “Full-Scope Examination Requirement and Types of Supervisory Activities” section of this 
booklet for criteria. 
Case 3:21-md-02992-GPC-MSB     Document 350-110     Filed 10/24/24     PageID.11990 
Page 14 of 23

Version 1.2 
Comptroller’s Handbook 
20 
Large Bank Supervision 
Coordination With Other Regulators 
 
Related “Bank Supervision Process” Booklet Sections 
● “Introduction” > “Bank Affiliates and Related Organizations” 
● “Examination Authority and Full-Scope Examination Requirement” > “Specialty Area Considerations” > 
“Consumer Compliance” 
● “Risk-Based Supervision Approach” > “Supervisory Process” > “Planning” > “Coordination With Other 
Regulators” 
● Appendix A, “Functional Regulation” 
 
Effective planning for supervision of midsize and large banks, especially complex, 
diversified companies, requires adequate and timely communication among supervisory 
agencies, including functional regulators. Effective functional supervision is attained through 
close cooperation and coordination among the various regulators. EICs should maintain open 
channels of communication with other regulators and work directly with them on bank-
specific items. By doing so, EICs help promote comprehensive supervision and reduce the 
burden of overlapping jurisdiction on the regulated entities. 
 
Examiners should be aware of the bifurcated authorities between the CFPB and the OCC for 
banks with more than $10 billion in assets. The prudential regulators and the CFPB signed a 
Memorandum of Understanding on Supervisory Coordination dated May 16, 2012, intended 
to facilitate the coordination of supervisory activities involving financial institutions with 
more than $10 billion in assets as required under Dodd–Frank.33 
 
When planning supervisory activities, examiners must follow existing written sharing 
agreements, delegation orders, interagency agreements, OCC policies, and laws and 
regulations governing cooperation and information sharing with other regulators. Interagency 
guidelines on coordination among U.S. banking regulators are detailed in Banking Bulletin 
1993-38, “Interagency Examination Coordination Guidelines.” Examiners planning 
supervisory activities of international operations should also coordinate with the International 
Banking Supervision Division regarding communications with foreign bank supervisors. 
 
Supervisory Activity Components 
 
Supervisory activities, regardless of type, include discovery, correction (when applicable), 
monitoring, and examination management. When assessing the bank’s condition, examiners 
must consider the risk associated with activities performed by the bank and its nonbank 
subsidiaries and affiliates. 
 
 
33 Refer to OCC news release 2012-85, “Agencies Sign Memorandum of Understanding on Supervisory 
Coordination.” 
Case 3:21-md-02992-GPC-MSB     Document 350-110     Filed 10/24/24     PageID.11991 
Page 15 of 23

Version 1.2 
Comptroller’s Handbook 
21 
Large Bank Supervision 
Discovery 
 
Related “Bank Supervision Process” Booklet Section 
● “Risk-Based Supervision Approach” > “Supervisory Process” > “Supervisory Activity Components” 
> “Discovery” 
 
Through discovery, examiners gain a fundamental understanding of the bank’s condition, 
quality of management, and effectiveness of risk management systems. This understanding 
helps examiners focus on the areas of greatest concern. A primary objective of discovery is to 
validate the integrity of the bank’s risk management systems. During the validation process, 
examiners should perform independent tests in proportion to the risks they find, to validate 
the bank’s key control functions. 
 
In discovery, examiners 
 
• evaluate the bank’s condition. 
• identify and quantify risks. 
• evaluate bank management’s and the board’s awareness and understanding of the 
significant risks. 
• assess the quality of risk management. 
• perform sufficient testing to verify the integrity of risk management systems (including 
internal and external audits and internal controls). 
• identify unwarranted levels of risk, deficient risk management practices, and the 
underlying causes of any deficiencies. 
 
Examiners’ assessments form the foundation for future supervisory activities. Bank 
supervision is an ongoing process that enables examiners to periodically confirm and update 
their assessments to reflect current or emerging risks. This revalidation is fundamental to 
effective supervision. 
 
Correction 
 
Related “Bank Supervision Process” Booklet Sections 
● “Risk-Based Supervision Approach” > “Supervisory Process” > “Supervisory Activity Components” 
> “Correction” 
● “Supervisory Actions” 
 
The OCC uses various supervisory actions, including MRAs, citations of violations of laws 
or regulations, or enforcement actions to address banks’ deficiencies. In the correction 
process, examiners obtain commitments from bank management to correct each deficiency.34 
 
 
34 For more information, refer to the “Supervisory Actions” section of the “Bank Supervision Process” booklet 
of the Comptroller’s Handbook. 
Case 3:21-md-02992-GPC-MSB     Document 350-110     Filed 10/24/24     PageID.11992 
Page 16 of 23

Version 1.2 
Comptroller’s Handbook 
22 
Large Bank Supervision 
The bank’s plans for corrective actions should be formally communicated through action 
plans. Action plans detail steps or methods that bank management has determined will 
correct the root causes of deficiencies rather than symptoms. Bank management is 
responsible for developing and executing action plans. Directors are expected to hold bank 
management accountable for executing action plans. Action plans should 
 
• specify actions to correct deficiencies. 
• address the underlying root causes of deficiencies. 
• set realistic time frames for completion. 
• establish benchmarks to measure progress toward completion. 
• identify the bank personnel who will be responsible for correcting deficiencies. 
• detail how bank management will effectively execute the plan, and how the board will 
oversee bank management’s actions. 
 
Monitoring 
 
Related “Bank Supervision Process” Booklet Section 
● “Risk-Based Supervision Approach” > “Supervisory Process” > “Supervisory Activity Components”  
> “Monitoring” 
 
Ongoing monitoring allows the OCC to respond in a timely manner to risks facing individual 
banks and the industry as a whole. The dynamic nature of midsize and large banks makes 
monitoring an important part of effective supervision. (Updated in version 1.2) 
 
In monitoring the bank, examiners 
 
• identify current and prospective issues that affect the bank’s risk profile or condition. 
• determine how to focus future supervisory strategies. 
• follow up on bank management’s progress in correcting outstanding MRAs, violations of 
laws or regulations, and complying with enforcement actions, which includes 
– assessing bank-prepared action plans to resolve each deficiency, including the 
appropriateness of the time frames for correction. 
– determining whether the bank is executing its action plans. 
– verifying the bank’s documentation to confirm that bank management completed its 
corrective actions. 
– validating that bank management’s corrective actions are effective and sustainable. 
– recommending the use of informal or formal enforcement actions when warranted. 
• communicate with bank management regarding areas of concern, if any. 
 
Examiners must tailor monitoring to each bank. Monitoring activities are focused on 
assessing the bank’s risks, including any potential material risks posed by functionally 
regulated activities conducted by the bank or FRAs. Monitoring activities are adjusted to 
include the risks facing each significant affiliated OCC-supervised bank. More complex 
banks generally require more frequent and comprehensive oversight. In addition to assessing 
the bank’s progress in executing plans and correcting deficiencies, examiners are required to 
Case 3:21-md-02992-GPC-MSB     Document 350-110     Filed 10/24/24     PageID.11993 
Page 17 of 23

Version 1.2 
Comptroller’s Handbook 
23 
Large Bank Supervision 
meet certain minimum requirements for monitoring activities for midsize and large banks. 
(Updated in version 1.2) 
 
Examination Management 
 
Related “Bank Supervision Process” Booklet Section 
● “Risk-Based Supervision Approach” > “Supervisory Process” > “Supervisory Activity Components”  
> “Examination Management” 
 
The EIC (including the functional EIC or EIC of a particular activity, as applicable) is 
responsible for effective examination management and must provide an organized 
environment in which supervisory goals and objectives can be achieved within appropriate 
time frames. During the examination, examining staff must inform the EIC of preliminary 
conclusions, and the EIC must evaluate progress toward completing the supervisory 
objectives. 
 
Communication 
 
Related “Bank Supervision Process” Booklet Section 
● “Risk-Based Supervision Approach” > “Supervisory Process” > “Supervisory Activity Components”  
> “Communication” 
 
Communication is essential to high-quality bank supervision. The OCC is committed to 
ongoing, effective communication with the banks that it supervises and with other banking 
and functional regulators. Communication includes formal and informal conversations and 
meetings, ROEs, supervisory letters, and other written materials. Regardless of form, 
communications should convey a consistent conclusion regarding the bank’s condition. 
Communication should be ongoing throughout the supervisory process and tailored to the 
bank’s structure and dynamics. The timing and form of communication depends on the 
situation being addressed. Examiners should communicate with bank management and the 
board as often as the bank’s condition and supervisory findings require. Examiners should 
include plans for communication in the supervisory strategy. 
 
Examiners should meet with bank management frequently and directors as needed to collect 
information and discuss supervisory issues. These discussions, which establish and maintain 
open lines of communication, are an important source of information. Examiners should 
document these meetings in the OCC’s supervisory information systems. 
 
When the OCC is considering an enforcement action, examiners should use care in 
communications with the bank related to the potential enforcement action. Examiners should 
consult with the supervisory office and assigned legal counsel before meeting with the bank 
regarding a potential enforcement action. 
 
Case 3:21-md-02992-GPC-MSB     Document 350-110     Filed 10/24/24     PageID.11994 
Page 18 of 23

Version 1.2 
Comptroller’s Handbook 
24 
Large Bank Supervision 
Communication During Examinations 
 
Related “Bank Supervision Process” Booklet Section 
● “Risk-Based Supervision Approach” > “Supervisory Process” > “Communication” > “Communication During 
Examinations” 
 
Entrance Meetings With Bank Management 
 
The EIC meets with appropriate bank or company management at the beginning of an 
examination to 
 
• explain the scope of the examination, the role of each examiner, and how the examination 
team conducts the examination. 
• confirm the availability of bank personnel. 
• establish expectations regarding follow-up requests throughout the examination. (Added 
in version 1.2) 
• identify communication contacts. 
• answer any questions. 
 
If an examination is conducted jointly with another regulator, the OCC should invite a 
representative from that agency to participate in the entrance meeting. 
 
Ongoing Communication During Examinations 
 
Ongoing communication and discussions with bank management allow examiners to obtain 
the information necessary to reach sound and accurate conclusions. Periodic meetings with 
bank management are essential during the examination. Discussion of key issues and 
preliminary findings prevents misunderstanding and allows bank management to provide 
more information. 
 
Exit Meetings With Bank Management 
 
After each examination is completed, the EIC holds an exit meeting with bank or company 
management to 
 
• discuss the OCC’s findings and conclusions. 
• discuss deficiencies and obtain bank management’s commitments for corrective action. 
• discuss the areas of greatest risk to the bank. 
• provide preliminary ratings and RAS conclusions, when applicable. 
• outline plans for future supervisory activities, when possible. 
 
The EIC should encourage bankers to respond to OCC concerns, provide clarification, ask 
about future supervisory plans, and raise any other questions or concerns. At the exit 
meeting, the examiners ask for bank management’s commitment to correct deficiencies 
Case 3:21-md-02992-GPC-MSB     Document 350-110     Filed 10/24/24     PageID.11995 
Page 19 of 23

Version 1.2 
Comptroller’s Handbook 
25 
Large Bank Supervision 
identified during the supervisory activity and, when appropriate, offer examples of 
acceptable solutions. (Updated in version 1.2) 
 
Examiners may conduct exit meetings with bank management of specific departments or 
functions before the final exit meeting. The functional EICs summarize the issues and 
commitments for corrective actions from these meetings. The bank EIC then discusses the 
issues and commitments with senior bank management at the final exit meeting. (Updated in 
version 1.2) 
 
Before the exit meeting, the EIC should discuss significant findings, including preliminary 
ratings and RAS conclusions, with the appropriate OCC supervisory office. Meeting with the 
supervisory office promotes consistent application of OCC policy, and confirms that OCC 
management supports the conclusions and the course of action for any deficiencies. The EIC 
and the supervisory office should decide who attends the exit meeting on the OCC’s behalf, 
and the EIC should inquire about the attendance of senior bank management and others. If 
the examination was conducted jointly with another agency, the EIC or supervisory office 
should invite a representative from that agency to participate in the exit meeting. 
 
Examiners must convey significant decisions discussed during the exit meeting in written 
correspondence. Examiners should discuss issues with bank management before discussing 
them with the board, unless, in the supervisory office’s view, the subject is best approached 
confidentially with the board. 
 
Written Communication 
 
Related “Bank Supervision Process” Booklet Sections 
● “Risk-Based Supervision Approach” > “Supervisory Process” > “Communication” > “Written 
Communication” 
● “Supervisory Actions” 
● “Other Supervisory Considerations” > “Disclosure of Ratings” 
● “Report of Examination” 
 
Written communication of supervisory activities and findings is essential to effective 
supervision. Examiners should periodically provide written communication to the board 
highlighting concerns that arise during the supervisory process. Written communication 
should focus the board’s attention on the OCC’s major conclusions, including any 
supervisory concerns. 
 
Written communication must 
 
• be consistent with the tone, findings, and conclusions orally communicated to the bank. 
• convey the condition of the bank or, if appropriate, the condition of an operational unit of 
the bank. 
• be addressed to the appropriate audience based on the nature of the content and how the 
bank or company is structured and managed. 
• discuss any concerns the OCC has about bank risks or deficiencies. 
Case 3:21-md-02992-GPC-MSB     Document 350-110     Filed 10/24/24     PageID.11996 
Page 20 of 23

Version 1.2 
Comptroller’s Handbook 
26 
Large Bank Supervision 
• summarize the actions required to address deficiencies, including bank management’s 
commitment to corrective action. 
 
Reports of Examination 
 
In addition to written communication throughout a supervisory cycle, the OCC must 
provide the boards of the lead OCC-supervised bank and each affiliated OCC-
supervised bank an ROE at least once during every supervisory cycle. For federal 
branches and agencies that do not have boards, the OCC provides the ROE to local branch 
management. The OCC also provides a “head office letter” to the parent bank of U.S. 
regulated federal branches and agencies summarizing the general condition of the branch or 
agency. (Updated in version 1.2) 
 
The ROE conveys the bank’s overall condition and risk profile and summarizes examination 
activities and findings during the supervisory cycle. The ROE 
 
• contains conclusions on assigned regulatory ratings, the bank’s risk profile, and the 
adequacy of the bank’s BSA/AML compliance program. 
• discusses deficient risk management practices, violations, and excessive risks. 
• details corrective actions to which bank management or the board has committed. 
 
ROE requirements can be found in the “Report of Examination” section of the “Bank 
Supervision Process” booklet of the Comptroller’s Handbook. 
 
Meetings With Directors 
 
Related “Bank Supervision Process” Booklet Section 
● “Risk-Based Supervision Approach” > “Supervisory Process” > “Communication” > “Meetings With 
Directors” 
 
The OCC maintains communication with boards throughout the supervisory cycle to discuss 
OCC examination results and other matters of mutual interest, including current industry 
issues, emerging industry risks, and legislative issues. The EIC meets with the board or an 
authorized committee that includes outside directors after the board or committee has 
reviewed the ROE. If necessary, the OCC meets with the board to discuss how the board 
should respond to supervisory concerns and issues. 
 
The OCC should conduct a board meeting at least once during the supervisory cycle for the 
lead OCC-supervised bank. More frequent meetings should be conducted when justified by 
the bank’s condition or special supervisory needs. When meetings are routinely conducted 
with board committees, examiners are encouraged to meet periodically with the full board to 
confirm findings and facilitate effective communication. Examiners should conduct board 
meetings with affiliated OCC-supervised banks that are not lead OCC-supervised banks only 
when significant supervisory concerns exist or when meetings are expected to enhance 
overall supervision. Senior management of the appropriate OCC supervisory office should 
attend and participate in board meetings with midsize and large banks. If the examination 
Case 3:21-md-02992-GPC-MSB     Document 350-110     Filed 10/24/24     PageID.11997 
Page 21 of 23

Version 1.2 
Comptroller’s Handbook 
27 
Large Bank Supervision 
was conducted jointly with another regulator, the supervisory office should invite a 
representative from that agency to participate in the board meeting. 
 
The EIC conducting the meeting should be prepared to discuss conclusions, findings, any 
concerns, and methods of corrective action (if applicable). The EIC should encourage 
directors to ask questions or make comments. 
 
Documentation 
 
Related “Bank Supervision Process” Booklet Section 
● “Risk-Based Supervision Approach” > “Supervisory Process” > “Documentation” 
 
Documentation is an ongoing process throughout the supervisory cycle. Examiners must 
document their decisions and conclusions. Examiners document and communicate narrative 
and statistical information about OCC-supervised banks in the OCC’s electronic supervisory 
information systems. The OCC maintains limited information about affiliates of OCC-
supervised banks to help examiners assess risks to OCC-supervised banks from these 
affiliates.35 (Updated in version 1.2) 
 
The recorded information reflects the bank’s current condition, supervisory strategy, results 
of supervisory activities, the OCC’s actions in response to deficiencies (i.e., MRAs, 
violations of laws or regulations, and enforcement actions), and bank management’s progress 
in correcting deficiencies. Using this information and data, OCC senior management can 
review the condition of supervised banks and groups of banks. Other federal banking 
regulators also have access to certain information, as appropriate, through various formats. 
(Updated in version 1.2) 
 
Many electronic files are official records of the OCC and may be discoverable items in 
litigation. Examiners must be succinct, clear, and professional in their documentation and 
avoid informality that might be misunderstood or misused. 
 
The EIC and the supervisory office are responsible for maintaining accurate and up-to-date 
information in supervisory information systems for their assigned institutions. Examiners 
should record information as follows: 
 
• Comments pertaining to or affecting all OCC-supervised banks within a multibank 
organization should generally be recorded in the electronic file under the holding 
company or lead OCC-supervised bank, as appropriate. (Updated in version 1.2) 
• Comments particular to a bank should be recorded in the electronic file under that bank. 
 
 
 
35 For more information about affiliates, refer to the “Bank Affiliates and Related Organizations” section of this 
booklet. (Footnote added in version 1.2) 
Case 3:21-md-02992-GPC-MSB     Document 350-110     Filed 10/24/24     PageID.11998 
Page 22 of 23

Version 1.2 
Comptroller’s Handbook 
28 
Large Bank Supervision 
Core Assessment 
 
Core assessment establishes the minimum conclusions examiners must reach to assess risks 
and assign regulatory ratings. These minimum conclusions are documented in a core 
assessment summary. Examiners’ conclusions for each risk consider the interrelationships 
with other risks and cover all applicable lines of business and functions. (Updated in version 
1.2) 
 
Core Assessment Summary 
 
(Section updated in version 1.2) 
 
Examiners complete one consolidated core assessment summary for all OCC-supervised 
banks within a multibank organization during every supervisory cycle. Examiners consider 
the supervisory activities conducted throughout the supervisory cycle when completing the 
core assessment summary. The core assessment summary (or portions thereof) may be 
completed or updated more often when the EIC or supervisory office deems appropriate. The 
core assessment summary should provide OCC management and examiners with a clear and 
concise narrative to support the following minimum conclusions: 
 
• Conclusions for the quantity of risk, quality of risk management, aggregate risk, and 
direction of risk, for each RAS category, Bank Secrecy Act/anti-money laundering/Office 
of Foreign Assets Control (BSA/AML/OFAC) risk, and asset management risk, as 
applicable. Conclusions should be based on the definitions for quantity of risk, quality of 
risk management, aggregate risk, and direction of risk.36 
• Conclusions for internal controls and audit. Conclusions should be based on the 
definitions in this booklet for audit and internal controls assessments. 
• Conclusions for the assessment factors for the quantity of risk and quality of risk 
management for each RAS category, BSA/AML/OFAC risk, and asset management risk. 
• Conclusions for the assessment factors for internal controls, audit, and BSA (program and 
each pillar). 
• Conclusions for the regulatory ratings and regulatory rating assessment factors. 
Conclusions for regulatory ratings should be based on the regulatory rating definitions 
and assessment factors in the “Bank Supervision Process” booklet of the Comptroller’s 
Handbook. 
 
The assessment factors are the minimum standards that examiners must assess during every 
supervisory cycle to ensure quality supervision. Examiners must document conclusions for 
each risk and regulatory rating assessment factor. The sub-factors are material criteria, 
including risk appetite, risk profile, and risk governance criteria, that have been shown to 
 
36 For each RAS category, BSA/AML/OFAC risk, and asset management risk, this booklet includes definitions 
for low, moderate, and high quantity of risk and strong, satisfactory, insufficient, and weak quality of risk 
management. Refer to the “Bank Supervision Process” booklet for general definitions of quantity of risk, 
quality of risk management, aggregate risk, and direction of risk that apply to all risk assessments. (Footnote 
added in version 1.2) 
Case 3:21-md-02992-GPC-MSB     Document 350-110     Filed 10/24/24     PageID.11999 
Page 23 of 23

File and source

File

gov.uscourts.casd.709615.350.110.pdf

Size

1,066,303 bytes

SHA-256

5cce64e0e19e22d89d19ccf1a84c251b2c9abb1cba575f41095da1ede2aa6c2b

Our copy

gov.uscourts.casd.709615.350.110.pdf

Original

PACER (login required)