Lessons Learned from Remote Supervision during Pandemic Could Inform Future Disruptions (GAO-22-104659)
Summary
A GAO report to congressional committees, GAO-22-104659, dated September 2022, on bank supervision. It states that limitations on in-person meetings and travel because of the COVID-19 pandemic presented challenges to federal banking regulators conducting on-site examinations of depository institutions. GAO reports that the regulators, including the Consumer Financial Protection Bureau and the Federal Deposit Insurance Corporation, convened working groups to assess risks related to conducting fully remote bank examinations, among other actions. Its title states that lessons learned from remote supervision during the pandemic could inform future disruptions.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
Full text
United States Government Accountability Office
Report to Congressional Committees
September 2022
BANK SUPERVISION
Lessons Learned from
Remote Supervision
during Pandemic
Could Inform Future
Disruptions
Accessible Version
GAO-22-104659
September 2022
BANK SUPERVISION
Lessons Learned from Remote Supervision during
Pandemic Could Inform Future Disruptions
Highlights of GAO-22-104659, a report to
congressional committees
Why GAO Did This Study What GAO Found
Limitations on in-person meetings and To assess challenges that COVID-19 posed to their supervisory missions, the
travel because of the COVID-19 federal banking regulators convened working groups to assess risks related to
pandemic presented challenges to conducting fully remote bank examinations, among other actions. The regulators
federal banking regulators conducting are the Consumer Financial Protection Bureau (CFPB), Federal Deposit
on-site examinations of depository Insurance Corporation (FDIC), Board of Governors of the Federal Reserve
institutions. System, National Credit Union Administration (NCUA), and Office of the
The CARES Act includes a provision Comptroller of the Currency (OCC). Four regulators updated their enterprise risk
for GAO to monitor and oversee the management (ERM) frameworks to reflect pandemic-related risks. The Federal
federal government’s response to Reserve has been developing its ERM framework since 2017 and has not yet
COVID-19. This report examines how completed elements to capture risks to the agency’s supervisory mission,
the federal banking regulators (1) including those related to the pandemic. The Federal Reserve said it planned to
identified and assessed risks and complete these elements but had not documented planned steps or timeframes
challenges the pandemic posed to their as of June 2022. Office of Management and Budget guidance highlights the
supervisory missions, (2) made importance of updating ERM elements to reflect changes in risks. Including
changes to address these risks and pandemic-related risks to supervision in its ERM framework would better position
challenges, and (3) assessed lessons the Federal Reserve to manage future disruptions to examinations.
learned from their pandemic
responses. To manage pandemic-related challenges to their supervisory missions, banking
regulators deferred examination activities, expanded off-site monitoring of
GAO reviewed the five agencies’
institutions, adjusted telework policies, and provided technology tools and
policies and guidance, analyzed
agencies’ reviews of their performance internal guidance to examiners (see figure). In 16 of 20 small group interviews
during the pandemic, and interviewed GAO conducted, examiner staff at the agencies said the transition to remote
officials. GAO also conducted 20 work was smooth. Some examiners noted challenges examining institutions that
small-group interviews with lacked imaged loan files or technology to allow remote access to bank systems.
nongeneralizable samples of between
Federal Banking Regulators’ Actions to Address Pandemic-Related Challenges to Conducting
two and five groups of examiners from Fully Remote Examinations
each agency (total of 110 examiners
across the five agencies).
What GAO Recommends
GAO is making two recommendations,
including that the Federal Reserve
develop and document steps and
timeframes to include pandemic-
related risks to supervision in its ERM
framework and that OCC review
lessons learned from the pandemic to
better prepare for future disruptions to
examinations. The Federal Reserve
neither agreed nor disagreed with The Federal Reserve, FDIC, NCUA, and CFPB have taken or planned steps
GAO’s recommendation and OCC said reflecting GAO-identified practices to identify and share lessons learned. Post-
it would complete a review by March crisis assessments to identify lessons learned can help agencies develop
2023. strategies for future disruptions. As of June 2022, OCC had not yet undertaken or
planned a review of lessons learned from its pandemic response. Taking
additional steps to review lessons learned such as collecting, analyzing, and
View GAO-22-104659. For more information,
contact Michael E. Clements at (202) 512- sharing information could help OCC better prepare for future disruptions.
8678 or ClementsM@gao.gov.
United States Government Accountability Office
Contents
Letter 1
Background 3
Regulators Assessed Pandemic-Related Risks, but the Federal
Reserve Has Not Completed an Enterprise-Wide Framework
That Includes These Risks 6
Banking Regulators Took Actions to Address Pandemic
Examination Challenges 12
Regulators Analyzed Pandemic Impacts and Four Reviewed
Lessons Learned, but OCC Did Not 21
Conclusions 25
Recommendations for Executive Action 26
Agency Comments and Our Evaluation 26
Appendix I: Objectives, Scope, and Methodology 30
Appendix II: Examinations by Federal Banking Regulators, 2016–2021 35
Federal Prudential Banking Regulators 35
Appendix III: Comments from the Board of Governors of the Federal Reserve System 43
Agency Comment Letter 45
Appendix IV: Comments from the National Credit Union Administration 47
Agency Comment Letter 48
Appendix V: Comments from the Office of the Comptroller of the Currency 49
Agency Comment Letter 50
Appendix VI: Contacts and Staff Acknowledgments 52
Tables
Table 1: Types and Numbers of Depository Institutions Examined
by Federal Banking Regulators, as of December 2021 4
Page i GAO-22-104659 Bank Supervision
Table 2: Examples of Banking Regulators’ Temporary Supervision
Decision-Making Groups during the COVID-19 Pandemic 8
Table 3: Actions by Federal Banking Regulators to Defer
Scheduling of Bank Examinations, March–December
202014
Table 4: Number of Agency Examination Staff Interviewed about
Pandemic Experiences 32
Figures
Figure 1: Federal Banking Regulators’ Actions to Address
Pandemic-Related Challenges to Conducting Fully
Remote Examinations 13
Figure 2: Number of FDIC Examinations of Insured Depository
Institutions, 2016–2021 37
Figure 3: Number of Federal Reserve Examinations of Depository
Institutions That Are Members of the Federal Reserve
System, 2016–2021 38
Figure 4: Number of NCUA Examinations, 2016–2021 39
Figure 5: Number of OCC Examinations, 2016–2021 40
Figure 6: Number of CFPB Examinations, Targeted Reviews, and
Prioritized Assessments, 2019–2021 42
Abbreviations
CFPB Consumer Financial Protection Bureau
ERM enterprise risk management
FDIC Federal Deposit Insurance Corporation
Federal Reserve Board of Governors of the Federal Reserve System
NCUA National Credit Union Administration
OCC Office of the Comptroller of the Currency
OMB Office of Management and Budget
This is a work of the U.S. government and is not subject to copyright protection in the
United States. The published product may be reproduced and distributed in its entirety
without further permission from GAO. However, because this work may contain
copyrighted images or other material, permission from the copyright holder may be
necessary if you wish to reproduce this material separately.
Page ii GAO-22-104659 Bank Supervision
441 G St. N.W.
Washington, DC 20548
Letter
September 8, 2022
Congressional Addressees
Beginning in the spring of 2020, limitations on in-person meetings and
travel resulting from the spread of COVID-19 presented operational
challenges to federal banking regulators in performing supervisory and
other critical functions.1 Regulators could not conduct on-site
examinations of regulated institutions and had to make adjustments to
conduct oversight remotely.2 The federal banking regulators that conduct
such examinations of depository institutions include the Consumer
Financial Protection Bureau (CFPB), Federal Deposit Insurance
Corporation (FDIC), Board of Governors of the Federal Reserve System
(Federal Reserve), National Credit Union Administration (NCUA), and
Office of the Comptroller of the Currency (OCC).3
The CARES Act includes a provision for us to monitor and oversee the
federal government’s efforts to prepare for, respond to, and recover from
COVID-19.4 This report examines (1) how federal banking regulators
identified and assessed risks and challenges the pandemic posed to their
supervisory missions, (2) adjustments they made to examination activities
to address key risks and challenges, and (3) steps they have taken to
monitor the effects of pandemic-related changes and identify lessons
1For purposes of this report, the term banking regulators includes supervisors of bank and
credit union depository institutions.
2The banking regulators also made temporary regulatory changes to encourage financial
institutions to provide credit and flexibility on loan repayment terms to borrowers facing
disruptions from COVID-19. Those changes are outside the scope of this review.
3The 12 Federal Reserve banks that are part of the Federal Reserve System carry out
Federal Reserve core functions, including supervising and examining banks that are state
chartered and are members of the Federal Reserve System and bank and thrift holding
companies. Federal Reserve Banks also supervise nonbank financial institutions that have
been designated as systemically important under authority delegated to them by the
Federal Reserve Board. The Securities and Exchange Commission and Commodity
Futures Trading Commission also have financial oversight responsibilities, which were
outside the scope of this review.
4Pub. L. No. 116-136, § 19010(b), 134 Stat. 281, 580 (2020). All of GAO's reports related
to the COVID-19 pandemic are available on GAO's website at
https://www.gao.gov/coronavirus.
Page 1 GAO-22-104659 Bank Supervision
Letter
learned from their responses to the pandemic disruption to on-site
examinations.
To address the first objective, we reviewed charters, meeting agendas,
and other documentation of the agencies’ working groups that served to
assess risks and consider risk responses. In addition, we reviewed
documentation of the agencies’ enterprise risk management (ERM)
frameworks and compared agencies’ efforts to implement and update
their ERM frameworks against Office of Management and Budget (OMB)
guidance on implementing ERM in federal agencies.5 We also interviewed
officials from the five agencies about their risk management efforts.
To address the second objective, we reviewed agency policies,
procedures, and internal guidance and communications provided to
examiner staff related to the agencies’ response to the pandemic. We
interviewed the agencies’ supervision officials. We also conducted 20
small-group interviews with nongeneralizable samples of between four
and 10 examiners from each of the five agencies (a total of 110
examiners). We selected groups to represent a range of positions,
responsibilities, and regional locations, including groups of examiners that
manage teams of examiners and groups of nonmanagerial examiners.
We conducted two group interviews with CFPB staff, three group
interviews with NCUA staff, and five group interviews each with FDIC,
Federal Reserve, and OCC staff.
To address the third objective, we reviewed agency reports, slide
presentations, and other documentation related to the pandemic’s effects
on bank supervision, including data on examination hours, duration, and
staffing. In addition, we reviewed agency data on the number of
examinations and other supervisory activities conducted in 2016–2021.
To assess the reliability of the data, we reviewed related documentation
and interviewed knowledgeable staff at the regulators. We concluded that
applicable data were sufficiently reliable for purposes of reporting
aggregate annual examination numbers. We also reviewed agency
reports, memorandums, and other documentation of the agencies’ efforts
to assess and share lessons learned from their responses to the
5Office of Management and Budget, Management’s Responsibility for Enterprise Risk
Management and Internal Control, OMB Circular A-123 (Washington, D.C.: July 15, 2016).
Although the financial regulators are not necessarily required to adhere to OMB guidance,
agencies with ERM frameworks, including CFPB and FDIC, have voluntarily opted to
follow OMB guidance on ERM.
Page 2 GAO-22-104659 Bank Supervision
Letter
pandemic disruption, and we interviewed staff about these issues. We
compared their lessons-learned efforts to GAO-identified practices for
identifying and applying lessons learned.6 For more information about our
scope and methodology, see appendix I.
We conducted this performance audit from March 2021 to September
2022 in accordance with generally accepted government auditing
standards. Those standards require that we plan and perform the audit to
obtain sufficient, appropriate evidence to provide a reasonable basis for
our findings and conclusions based on our audit objectives. We believe
that the evidence obtained provides a reasonable basis for our findings
and conclusions based on our audit objectives.
Background
Federal Regulatory Oversight of Depository Institutions
Four federal prudential regulators—FDIC, Federal Reserve, NCUA, and
OCC—oversee their respective depository institutions in part by
conducting examinations to assess the institutions’ safety and soundness
and compliance with consumer protection and other laws (see table 1).7
CFPB regulates the offering and provision of consumer financial products
or services. For depository institutions with over $10 billion in total assets
(and their affiliates), CFPB has examination authority as well as primary
enforcement authority for the federal consumer financial laws.8
6GAO, Federal Real Property Security: Interagency Security Committee Should Implement
a Lessons-Learned Process, GAO-12-901 (Washington, D.C.: Sept. 10, 2012).
7State banking regulators also conduct examinations; state and federal banking regulators
alternate examining state-chartered institutions that are also subject to federal regulation.
The regulation of safety and soundness for depository institutions depends on the type of
institution (commercial bank, thrift, or credit union) and the origin of the institution’s charter
(federal or state). Regulators use the Uniform Financial Institutions Rating System—
commonly known as CAMELS—to, among other things, monitor aggregate trends in
overall soundness of financial institutions and assess their exposure to risks. The ratings
regulators assign under this system reflect a bank’s condition in six areas: capital, asset
quality, management, earnings, liquidity, and sensitivity to market risk.
8Pursuant to the Consumer Financial Protection Act of 2010 (Title X of the Dodd-Frank
Wall Street Reform and Consumer Protection Act), CFPB has rulemaking authority for
federal consumer financial laws. 12 U.S.C. §§ 5512, 5581. The definition of federal
consumer financial law expressly excludes the Federal Trade Commission Act. 12 U.S.C.
§ 5481(14).
Page 3 GAO-22-104659 Bank Supervision
Letter
Table 1: Types and Numbers of Depository Institutions Examined by Federal Banking Regulators, as of December 2021
Number of
depository
Divisions responsible Types of depository institutions under Number of
Regulator for examinations institutions examined supervision examination staff
Consumer Financial Division of Supervision, Depository institutions and 199 400b
Protection Bureau (CFPB) Enforcement, and Fair affiliates with assets over
Lending $10 billiona
Federal Deposit Insurance Division of Risk FDIC-insured, state- 3,122 2,093
Corporation (FDIC) Management Supervision chartered institutions that
Division of Depositor and were not members of the
Consumer Protection Federal Reserve System,
including large banks (total
Division of Complex assets $10 billion or greater)
Institution Supervision and and mid-size and community
Resolution banks (total assets under
$10 billion)c
Board of Governors of the Division of Supervision and State member banks, 952d 1,852e
Federal Reserve System Regulation including regional and
(Federal Reserve) Division of Consumer and community banking
Community Affairs organizations and foreign
banking organizations
National Credit Union Office of Examination and Credit unions 4,942 685
Administration (NCUA) Insurance
Office of Consumer
Financial Protection
Office of the Comptroller of Large Bank Supervision Nationally chartered banks 978 2,379
the Currency (OCC) Mid-size and Community and federal savings and loan
Bank Supervision associations
Source: GAO summary of CFPB, FDIC, Federal Reserve, NCUA, and OCC information. | GAO-22-104659
a
CFPB has supervisory authority over nonbank financial institutions, including payday lenders,
student loan originators, and nonbank mortgage originators and servicers. CFPB also supervises
larger participants of other consumer financial markets (as defined by CFPB rules) in consumer
reporting, consumer debt collection, student loan servicing, international money transfer, and
automobile financing. CFPB recently announced it had begun to use its authority to supervise
nonbanks whose activities CFPB had “reasonable cause to determine” posed risks to consumers.
See 12 U.S.C. § 5514(a)(1)(C).
b
Examination staff as of August 2021.
c
Under the exercise of FDIC’s authority to conduct special (backup) examination activities, FDIC
regularly monitors the potential risks at all insured institutions, including those for which it is not the
primary federal supervisor. 12 USC 1820(b)(3).
d
Number of institutions under supervision as of November 2021. The Federal Reserve also
supervises approximately 3,621 bank holding companies.
e
Examination staff as of July 2021.
Page 4 GAO-22-104659 Bank Supervision
Letter
FDIC, the Federal Reserve, and OCC are required under provisions of
the Federal Deposit Insurance Act to conduct a full-scope safety and
soundness examination of each insured depository institution they
supervise at least once during each 12-month period.9 The regulators
may extend the examination interval to 18 months, generally for
institutions that have less than $3 billion in total assets and that meet
certain conditions, based on ratings, capitalization, and status of formal
enforcement actions.10 Under the Federal Credit Union Act, NCUA
conducts examinations of credit unions.11 It also has an extended
examination cycle (14 to 20 months) for federal credit unions that meet
certain conditions based on assets size, ratings, capitalization, and status
of formal examination cycles.12 Under the Dodd-Frank Wall Street Reform
and Consumer Protection Act, CFPB uses a risk-based approach to
setting its annual examination schedule. It then shares its examination
schedule with the prudential and state regulators to identify coordination
opportunities.13
Enterprise Risk Management
Enterprise risk management (ERM) is a forward-looking management
approach that allows agencies to assess risks and opportunities that
could affect the achievement of their goals. ERM is one tool that can
assist federal leaders in anticipating and managing risks, as well as
considering how multiple risks in their agency can present even greater
challenges and opportunities when examined as a whole, rather than in
silos. ERM allows leadership to view risks across an organization’s
portfolio of responsibilities. OMB has defined “risk” as the effect of
uncertainty on objectives. Risk management is a series of coordinated
912 U.S.C. § 1820(d)(1). FDIC administers the Deposit Insurance Fund. It is also
responsible for overseeing resolution planning for large, complex financial institutions. The
Federal Reserve, in addition to conducting bank examinations, conducts periodic stress
tests for the largest bank holding companies.
1012 U.S.C. § 1820(d)(4).
1112 U.S.C. §§ 1756, 1784. NCUA also administers the National Credit Union Share
Insurance Fund. This fund provides primary deposit insurance for member accounts and
is backed by the full faith and credit of the U.S. federal government.
12Examination for all other federal credit unions begins between 8 and 12 months from the
prior examination completion date.
1312 U.S.C. § 5514(b)(3); 12 U.S.C. § 5515(e).
Page 5 GAO-22-104659 Bank Supervision
Letter
activities to direct and control challenges or threats to achieving an
organization’s goals and objectives.
OMB Circular A-123 specifies elements that federal agencies’ ERM
frameworks should include and steps agencies should take to develop
these frameworks.14 These include a planned risk management
governance structure, a process for considering risk appetite and risk
tolerance levels, a methodology for developing a risk profile, a general
implementation timeline, and a plan for maturing the comprehensiveness
and quality of the risk profiles over time.15 OMB defines the risk profile as
a prioritized inventory of the most significant risks identified and assessed
through the risk assessment process. The risk profile assists in facilitating
a determination about the aggregate level and types of risk that the
agency and its management are willing to assume to achieve its strategic
objectives. The risk register is a comprehensive list of risks that identifies
the relevant source of the risk and the risk owner and that tracks the
treatment of the risk.
Regulators Assessed PandemicRelated Risks,
but the Federal Reserve Has Not Completed an
EnterpriseWide Framework That Includes
These Risks
Banking Regulators Convened Groups to Identify Risks
and Challenges to Their Supervisory Missions
In the early months of the pandemic, the regulators relied on existing
leadership groups, and some convened new groups, to lead efforts to
understand the effects of the pandemic on supervised entities and adjust
their operations. Before the pandemic, all of the regulators conducted key
14OMB Circular A-123.
15The risk appetite is the amount of risk an organization is willing to accept in pursuit of its
mission. It is established by the organization’s most senior leadership and serves as the
guidepost to set strategy and select objectives. OMB defines risk tolerance as the
acceptable level of variance in performance relative to the achievement of objectives.
Page 6 GAO-22-104659 Bank Supervision
Letter
elements of their examinations on-site at supervised institutions.16 In mid-
March 2020, the regulators took steps to move all examiners to a fully
remote (telework) posture.17
In March and April 2020, examination staff contacted supervised
institutions and leveraged existing off-site monitoring tools to collect
information on institutions’ operational status and financial condition. They
focused on key areas that were potentially vulnerable to the economic
impact of the pandemic disruption, such as liquidity or credit risk.18 For
example, in March 2020, FDIC provided question sets to examiners-in-
charge of large bank examinations. These examiners provided
information based on examinations in progress about key issues related
to COVID-19 and any liquidity challenges. NCUA examination staff also
contacted supervised institutions to learn about any operational and
financial challenges they were facing. These efforts continued into 2021
for some regulators, as we discuss later in the report.
To coordinate intra-agency efforts to identify, assess, and respond to
pandemic-related risks and challenges to their supervisory missions, all of
the regulators relied on existing leadership groups within their supervision
divisions, and three—FDIC, the Federal Reserve, and NCUA—also
created new leadership groups (see table 2). For example, the Federal
Reserve’s Supervision and Regulation Division formed the Pandemic
16Under the Federal Deposit Insurance Act, FDIC, the Federal Reserve, and OCC are
required to conduct on-site examinations of supervised institutions. 12 U.S.C. §
1820(d)(1). NCUA and CFPB also conducted examination work on-site before the
pandemic and shifted to a fully remote telework posture beginning in March 2020.
17Shortly after the President declared a national emergency concerning the pandemic,
OMB issued memorandum M-20-16, “Federal Agency Operational Alignment to Slow the
Spread of Coronavirus COVID-19” (Mar. 17, 2020). The memorandum stated that the
federal government must immediately adjust operations and services to minimize face-to-
face interactions, especially at offices or sites where people might gather in close
proximity. Non-mission-critical functions that could not be performed remotely or required
in-person interactions could be postponed or significantly curtailed. The memorandum
instructed agency heads to utilize the full extent of their legal authority and discretion to
realign their agencies’ non-mission-critical activities, while also ensuring they continued to
serve the public and operated efficiently. GAO recently reviewed other federal agencies’
use of telework during the COVID-19 pandemic. See GAO, COVID-19: Selected Agencies
Overcame Technology Challenges to Support Telework but Need to Fully Assess Security
Controls, GAO-21-583 (Washington, D.C.: Sept. 30, 2021).
18Liquidity risk is the potential that a financial institution will be unable to meet its
obligations as they come due because it cannot liquidate assets, obtain adequate funding,
or unwind or offset exposures without significantly lowering market prices. Credit risk is
the risk that a borrower or counterparty will fail to perform on an obligation.
Page 7 GAO-22-104659 Bank Supervision
Letter
Analytics Workstream group, which developed a crisis response
framework operational plan that prioritized resource allocation according
to the Reserve Banks’ and management’s priorities during the pandemic.
The plan prioritized staffing examinations for banks deemed at higher risk
from the pandemic or assisting with implementing the Federal Reserve’s
CARES Act emergency lending facilities.19 NCUA convened a new task
force with members of senior leadership in its Office of Examination and
Insurance and operational areas, such as legal and economic research
departments, as well as regional office management, to monitor the
impact of the pandemic on supervised entities and develop a fully remote
supervisory strategy.
Table 2: Examples of Banking Regulators’ Temporary Supervision Decision-Making Groups during the COVID-19 Pandemic
Banking regulator Decision-making groupsa Purpose
Federal Deposit Insurance Temporary Examination Process Working Develop guidance for and monitor the
Corporation (FDIC) Group implementation of temporary examination
procedures
Board of Governors of the Federal Pandemic Analytics Workstream group Develop crisis response framework operational
Reserve System (Federal Reserve) plan and monitor the effectiveness of the
framework
Division of Consumer and Community Ensure consistency when resuming consumer
Affairs Supervisory Activities Resumption compliance examinations
Working Group
National Credit Union COVID-19 Economic Impact and Planning Monitor the impact of the pandemic on supervised
Administration (NCUA) Team entities and develop a fully remote supervisory
strategy
Risk Assessment and Data Analytics Rating Develop an off-site monitoring tool that could
Working Group identify credit unions affected by the pandemic
Source: GAO summary of FDIC, Federal Reserve, and NCUA information. | GAO-22-104659
a
The leadership of each regulator’s supervision division also made decisions about pandemic-related
issues. In addition, some agency-wide COVID-19 working groups made decisions about issues such
as telework policies. FDIC convened a Coronavirus Working Group, and the Consumer Financial
Protection Bureau and Office of the Comptroller of the Currency relied on supervision management
as well as these types of groups to make decisions during the pandemic.
19The CARES Act authorized at least $454 billion for the Department of the Treasury to
support the Federal Reserve in establishing facilities to provide liquidity to the financial
system. The Federal Reserve, with Treasury approval, used its authority under section
13(3) of the Federal Reserve Act to authorize 13 emergency lending facilities. See GAO,
Federal Reserve Lending Programs: Credit Markets Served by the Programs Have
Stabilized, but Vulnerabilities Remain, GAO-22-104640 (Washington, D.C.: Oct. 19,
2021).
Page 8 GAO-22-104659 Bank Supervision
Letter
The banking regulators identified risks and challenges to fulfilling their
supervisory missions in the following areas:
Reassessment of supervised entities’ risk profiles. Beginning in
March 2020, the regulators had to reassess the types of risks facing
regulated entities in light of the pandemic’s impacts on certain sectors of
the economy, such as retail and commercial real estate. For example,
depository institutions with large portfolios of loans or other financial
exposure to customers in these sectors faced higher risks—such as risks
of default on loans—than before the pandemic.
Transition to full-time remote examination work. Before the pandemic,
all of the banking regulators’ examination staff conducted key parts of
their examination work on-site at supervised entities, while some
preparatory and other activities took place off-site. However, beginning in
mid-March 2020, almost all examination staff were allowed to work full-
time remotely or off-site.20 This change posed a challenge to regulators to
ensure that examination staff had the equipment, supplies, and
technology tools to carry out their examination work in a fully remote
posture.
Staff and technology constraints at some supervised institutions.
Regulators were aware that the pandemic disruption could make it difficult
for institutions to respond to examiners’ requests for meetings and
information. Federal Reserve and FDIC officials noted that regulated
institutions had to devote staff resources to managing operational issues
and meeting customer needs in the pandemic environment. In addition,
many smaller banks and credit unions lacked imaged loan files or
electronic platforms that would enable examiners to review internal
systems remotely. Because staff at these institutions were also working
remotely, it was difficult for the institutions to have staff available to scan
documents or otherwise accommodate the off-site review process. As a
result, it was challenging for regulators to schedule examinations or to
obtain necessary documentation.
Limitations on examination staff resources. Banking regulators
identified potential challenges related to managing their staffing resources
for examinations during the pandemic. This included the potential for
some examination tasks to take longer and the reduced availability of
20Some examiners at some regulators were permitted to carry out examination or other
supervisory work on-site with senior management approval. FDIC required staff to work
off-site unless permission was granted to work on-site.
Page 9 GAO-22-104659 Bank Supervision
Letter
examination staff resulting from COVID-19-related leave for illness or
family or child-care responsibilities. For example, FDIC examinations of
smaller institutions took longer during the pandemic, so FDIC had to hire
additional staff temporarily to ensure it met its statutory requirements. The
Federal Reserve also had to temporarily reassign some examination staff
to assist with implementing the Federal Reserve emergency CARES Act
lending facilities.21
Four Banking Regulators Updated Risk Management
Programs to Reflect PandemicRelated Risks, but the
Federal Reserve Did Not
As noted previously, ERM is a forward-looking approach that allows an
agency to identify and assess risks and opportunities that could affect the
achievement of its goals. OMB Circular A-123 notes that an agency’s risk
identification process in its ERM is an ongoing process that should
include reexamining risks on a regular basis to identify new risks or
changes to existing risks. Four banking regulators with ERM
frameworks—CFPB, FDIC, NCUA, and OCC—updated key elements of
their ERM programs in 2020 and 2021 to reflect changes in risks,
including risks to their supervisory missions, that resulted from the
pandemic. In contrast, as of June 2022, the Federal Reserve had not
completed an ERM framework. Further, in its efforts to develop such a
framework, the Federal Reserve had not yet developed key elements
(such as a risk profile or risk register) related to identifying and assessing
risks to its supervisory mission, such as pandemic-related risks.
In 2020 and 2021, CFPB, FDIC, NCUA, and OCC updated their ERM risk
profiles, risk registers, or both as part of their periodic updates to ERM
elements.22 In doing so, the regulators modified these components of
ERM to reflect areas where the pandemic had elevated the risks
associated with carrying out their supervision program, among other
21See GAO-22-104640.
22OMB defines the risk profile as a prioritized inventory of the most significant risks
identified and assessed through the risk assessment process. The risk profile assists in
facilitating a determination about the aggregate level and types of risk that the agency and
its management are willing to assume to achieve its strategic objectives. The risk register
is a comprehensive list of risks that identifies the relevant source of the risk and the risk
owner and that tracks the treatment of the risk.
Page 10 GAO-22-104659 Bank Supervision
Letter
organizational areas.23 For example, FDIC updated its risk profile in 2021
and by 2022 had added to its risk register “COVID Impact on Banks’
Adherence to Consumer Compliance Laws and Regulations,” which
focused on effective monitoring of supervised institutions’ compliance with
consumer laws during the pandemic. FDIC also added “Examination
Approach” in 2020, which focused on the effectiveness of the Division of
Depositor and Consumer Protection’s off-site examinations. In April 2020,
CFPB added organizational resiliency to its risk profile to manage risks to
its operations during major economic events or national emergencies,
including risks within its supervision office.
Although the Federal Reserve began to develop an ERM framework in
2017, it has not yet completed some of OMB’s key recommended
elements related to identifying, assessing, and responding to risks. In
developing its ERM framework, the Federal Reserve has prioritized
developing risk profiles for its divisions responsible for providing support
to the Board’s administrative functions. As a result, the Federal Reserve
did not begin efforts to develop risk profiles for the Division of Supervision
and Regulation and the Division of Consumer and Community Affairs
before 2022, according to a Federal Reserve official leading the agency’s
ERM development. Officials told us that these efforts to develop risk
profiles will consider pandemic-related risks to the Federal Reserve’s
supervisory mission and that they plan to complete this work by
September 2022. However, as of June 2022, the Federal Reserve had
not developed and documented planned action steps and associated time
frames for these steps to complete these efforts.
In the absence of a completed enterprise-wide framework, the Federal
Reserve’s supervision divisions took steps, described earlier, to identify
and respond to pandemic-related risks to meeting the Federal Reserve’s
supervisory mission.24 Nevertheless, completing and implementing an
ERM framework could help ensure that Federal Reserve officials consider
risks and risk responses with an enterprise-wide view, including risks
23FDIC’s Division of Depositor and Consumer Protection also updated its business
contingency plan and developed a pilot using Microsoft Teams to proactively review
supervisory technology tools that may facilitate communication between institutions and
examiners. The Division of Risk Management Supervision provided examiners with
training that included emerging risks and trends during the pandemic.
24Some of these steps included, as noted previously, creating a new group to identify and
assess pandemic-related risks. The supervision divisions also coordinated with other
divisions on staffing-related challenges.
Page 11 GAO-22-104659 Bank Supervision
Letter
related to the pandemic disruption. The Federal Reserve Office of the
Inspector General issued a report in September 2021 recommending that
the Federal Reserve continue to make progress in completing its ERM
program.25 For example, the report found that with respect to planning,
the Federal Reserve could benefit from an assessment of the risk
management practices and risk culture currently in place across the
agency. As the Federal Reserve continues to develop its ERM
framework, developing a risk profile that includes key pandemic-related
risks to achieving its supervisory mission—such as risks related to
conducting supervisory activities during an extended interruption to on-
site examinations—could better position the Federal Reserve to leverage
its ERM framework to prepare for future disruptions.
Banking Regulators Took Actions to Address
Pandemic Examination Challenges
Regulators Leveraged Existing Tools and Issued New
Policies and Guidance to Manage the Shift to Remote
Examinations
To manage pandemic-related risks and challenges to their supervisory
missions, banking regulators took a number of actions. These included
deferring or pausing examination activities, performing additional off-site
monitoring of supervised institutions, adjusting telework policies, and
issuing guidance to examiners about changes to examination procedures,
among other actions (see fig. 1).
25Board of Governors of the Federal Reserve System Office of the Inspector General, The
Board’s Implementation of Enterprise Risk Management Continues to Evolve and Can Be
Enhanced, 2021-IT-B-011 (Washington, D.C.: Sept. 15, 2021). We have previously
recommended that, in developing its ERM framework, the Federal Reserve consider
integrating supervision-related risks, such as the reputational risks of regulatory capture.
The Federal Reserve neither agreed nor disagreed with this recommendation but detailed
steps it was taking to implement its ERM framework. This recommendation remains open.
See GAO, Large Bank Supervision: Improved Implementation of Federal Reserve Policies
Could Help Mitigate Threats to Independence, GAO-18-118 (Washington, D.C.: Nov. 6,
2017).
Page 12 GAO-22-104659 Bank Supervision
Letter
Figure 1: Federal Banking Regulators’ Actions to Address Pandemic-Related Challenges to Conducting Fully Remote
Examinations
Deferral of examination activities. In the first months of the pandemic,
all regulators offered to reschedule examinations or defer examination
start dates to provide institutions time to adjust to the pandemic
environment (see table 3).26 In March 2020, CFPB, FDIC, NCUA, and
OCC began to defer certain examinations or examination activities on a
case-by-case basis. Beginning on March 24, 2020, the Federal Reserve
temporarily ceased most regular examination activity for approximately 3
months for institutions with less than $100 billion in assets.27 As
discussed later in this section, after these initial deferrals of examinations,
regulators provided additional flexibilities around examination scheduling
throughout the pandemic, including to accommodate institutions that
needed more time to provide documentation for review.
26In addition to these temporary changes, regulators suspended penalties for late
submissions of quarterly Consolidated Reports of Conditions and Income (Call Reports).
27According to the Federal Reserve, the goal of the temporary change was to help
financial institutions deploy their resources as efficiently as possible and continue to serve
their customers Exceptions to this pause in examination work included instances where
the examination work was critical to safety and soundness or consumer protection, or was
required to address an urgent or immediate need. See Board of Governors of the Federal
Reserve System, Supervision and Regulation Report (Washington, D.C.: November
2020).
Page 13 GAO-22-104659 Bank Supervision
Letter
Table 3: Actions by Federal Banking Regulators to Defer Scheduling of Bank Examinations, March–December 2020
Regulator Deferrals of examination activities
Consumer Financial Protection Bureau March 2020: Deferred three examinations originally scheduled for April–June 2020.
(CFPB) April–December 2020: Deferred 14 examinations (approximately half of originally scheduled
examinations).
Federal Deposit Insurance Corporation March 2020: Provided banks the option to pause communications, such as responses to
(FDIC) FDIC requests for information.
April–December 2020: Deferred start dates for 39 examinations to later in 2020.
Board of Governors of the Federal March 24, 2020: Ceased examination activities and instead shifted to enhanced off-site
Reserve System (Federal Reserve) monitoring for most institutions with assets under $100 billion except where critical for safety
and soundness or consumer protection, or where required to address an urgent or immediate
need.
June 15, 2020: Resumed examination activities.
National Credit Union Administration March–December 2020: Deferred examinations on a case-by-case basis.
(NCUA)
Office of the Comptroller of the March–December 2020: Deferred examinations on a case-by-case basis.
Currency (OCC)
Source: GAO analysis of CFPB, FDIC, Federal Reserve, NCUA, and OCC information. | GAO-22-104659
In addition to deferring examinations, in May 2020 CFPB began using a
new supervisory tool called “Prioritized Assessments” to focus on entities
operating in markets that posed elevated risks of consumer harm
resulting from the pandemic. Prioritized Assessments had a narrower
period of review and scope than traditional examinations, focusing on the
most recent few months and pandemic-related issues. CFPB deferred
and rescheduled 14 examinations scheduled for the June–September
2020 examination period and instead conducted Prioritized Assessments.
Expanded off-site monitoring to reassess risks to institutions.
Banking regulators leveraged and expanded off-site monitoring activities
in place before the pandemic to identify institutions that were at higher
risk from the pandemic’s effects on market conditions. In between their
on-site examinations, federal banking regulators conduct off-site
monitoring of the financial condition of individual banks or groups of
banks with common product, portfolio, or risk characteristics. These
activities help regulators plan supervision strategies for the coming year.
Expanded off-site monitoring activities during the pandemic included
conducting outreach to institutions or gathering additional data about
economic and industry sector conditions. As noted previously,
examination staff at all five regulators informally contacted institutions to
understand the challenges they were encountering. For example, OCC
staff increased outreach to community banks in the first weeks after the
Page 14 GAO-22-104659 Bank Supervision
Letter
pandemic emergency. In addition, the Federal Reserve increased the
frequency of certain data reporting schedules to track evolving risks to the
banking sector.28 FDIC instituted weekly national monitoring of its larger
supervised bank portfolio, and it implemented a temporary heightened
monitoring program for financial institutions with under $10 billion in total
assets to establish a national framework to assess and address risks at
institutions resulting from direct and indirect effects of the pandemic.
The regulators also gathered and analyzed additional data on pandemic
impacts from institutions and third-party sources, such as federal
statistical bureaus. For example, as part of its Prioritized Assessment
process, CFPB analyzed market and other information about which
sectors were at greater risk of consumer harm during the pandemic. In
July 2020, NCUA implemented an off-site monitoring tool to identify credit
unions at heightened risk as a result of the pandemic. Specifically, the
Risk Assessment and Data Analytics Rating application rated a credit
union’s risk by assessing its credit, liquidity, and operational risk and by
stress testing.29
Expanded telework and new technology tools. Regulators revised
their existing telework policies to accommodate the shift to a maximum
telework posture in March 2020 in response to health and safety risks.
These policies varied from full-time mandatory telework at FDIC to
voluntary telework at OCC.30 However, banking regulator officials
28The Federal Reserve requested more frequent updates to Capital Assessments and
Stress Testing Reports (FR YA/Q/M).
29In April and May 2020, NCUA reached out to the credit union industry to determine the
status of operations and liquidity. In April 2020, NCUA examiners contacted credit unions
to obtain information on member services. Specifically, NCUA submitted questions to
determine the operational status of credit union premises, including lobbies and drive-
throughs, and whether credit unions were able to process new loans. For more
information, see GAO, National Credit Union Administration: Additional Actions Needed to
Strengthen Oversight, GAO-21-434 (Washington, D.C.: Sept. 23, 2021).
30OCC staff could work in person at OCC office locations without management approval,
according to officials.
Page 15 GAO-22-104659 Bank Supervision
Letter
estimated that the vast majority of examination staff worked remotely
through early 2022.31
Before the pandemic, each agency conducted some examination work
off-site and had provided examiners with equipment to allow them to
conduct on-site examinations at supervised institutions—such as laptops
and mobile internet access devices. During the pandemic the examiners
could use this equipment to work remotely. In addition, regulators
provided additional equipment, such as monitors for examiners’ use at
home, or funds for examiners to purchase home office equipment or
increase bandwidth of internet connections.
Regulators also implemented new technology tools or upgraded existing
ones, such as videoconferencing and secure document transmission
portals. Secure file exchange portals were a key tool regulators used to
help institutions transfer imaged loan files and other documentation to
examiners electronically. In addition, some agencies coordinated with
institutions to gain remote access to internal systems, so that examiners
could conduct examination activities such as loan reviews or transaction
testing remotely.
Issuance of guidance and communications to examiners. Regulators
issued both joint and individual guidance on temporary examination
procedures. In June 2020, FDIC, the Federal Reserve, NCUA, and OCC
issued joint guidance for examiners that outlined common supervisory
principles for assessing the safety and soundness of institutions, given
the ongoing impact of COVID-19.32 In addition, FDIC, the Federal
Reserve, NCUA, and OCC each individually issued temporary
supervisory guidance for their examiners that reinforced existing
examination procedures, while explaining how examiners could provide
additional flexibility to supervised institutions in light of the pandemic
disruption. For example, the regulators’ guidance included details on
31The Federal Reserve issued guidance on returning to work advising that Reserve Banks
should determine when it was appropriate to return to on-site examinations, consistent
with each Reserve Bank’s policy on returning to normal operations and consistent with the
direction provided by the working group of Reserve Bank First Vice Presidents, which
coordinates across the Reserve Banks on operational issues. The Federal Reserve stated
that it expects that on-site examination activities will once again be a regular part of the
examination process after the pandemic ends.
32FDIC, Federal Reserve, OCC, NCUA, in conjunction with state bank regulators, issued
Interagency Examiner Guidance for Assessing Safety and Soundness Considering the
Effect of the COVID-19 Pandemic on Institutions (June 2020).
Page 16 GAO-22-104659 Bank Supervision
Letter
determining the level of documentation needed to meet relevant
requirements or supervisory expectations for loan review. In addition to its
own new temporary guidance, the Federal Reserve also provided its
examiners with “toolkits,” which included decision trees to help examiners
decide on changes to documentation requests or other aspects of
examinations in a consistent way.33
In addition to written guidance, some regulators provided additional
updates to examiners through webinars or informational calls, or provided
resources on their internal websites. For example, NCUA provided
webinars on COVID-19-related examination changes and training
sessions on topics such as examinations of distressed institutions. The
Federal Reserve conducted a webinar in August 2021 to help examiners
transition from use of the temporary toolkits to the regulator’s
prepandemic supervisory approach. Some regulators also created
COVID-19 resource intranet websites for examiners to access pandemic-
related information or frequently-asked-questions documents based on
questions from examiners. Regulators also held “town hall” style forums
for staff to ask questions directly to management.
Adjustments to examination staffing. FDIC and the Federal Reserve
provided examples of steps they took to address particular staffing
challenges related to the pandemic disruption. As noted previously, FDIC
had to identify additional staff resources in part because aspects of
examinations, such as loan file reviews, were taking longer during the
pandemic. Beginning in December 2020, FDIC temporarily brought on
retired employees to assist in carrying out examinations and offered a
2020 leave buyback program to increase available work hours for existing
examination staff.34 The Federal Reserve shifted staff resources to
examinations of institutions deemed at higher risk during the pandemic
and to support implementation of its emergency lending facilities under
33Examiners noted that several Reserve Banks issued additional guidance to supplement
the toolkits from the Federal Reserve Board.
34To assess its hiring needs during periods of stress, FDIC’s Division of Risk Management
Supervision used a guidance document of contingency operating strategies that the
division had developed as a result of lessons learned during the 2007–2009 financial
crisis. Under FDIC’s leave buyback program, FDIC repurchased annual leave from
examiners to ensure additional examination hours were available in 2020 to address the
increased time needed to conduct off-site exams during the pandemic.
Page 17 GAO-22-104659 Bank Supervision
Letter
the CARES Act.35 OCC officials said they leveraged existing resource
allocation processes to ensure higher-risk institution examination
activities were appropriately staffed.
Staff Identified Aspects of Remote Examinations That
Worked Well and Challenges Related to Loan File Review
Officials and staff at all five banking regulators identified aspects of
remote examinations that generally worked well, such as the transition to
full-time telework, as well as areas where they encountered challenges—
particularly with examinations of smaller institutions that lacked imaged
loan files or technology to facilitate remote access to bank systems. As
noted previously, we conducted between two and five small-group
interviews with examination staff at each of the five regulators, for a total
of 20 interviews. The interviews focused on examiners’ perspectives on
what worked well and challenges to the implementation of off-site
supervision across areas such as the transition to telework and
communications to examiners about pandemic-related changes to
examinations.
Transition to full-time telework and experiences with technology.
Generally, examination staff we interviewed described their transition to
working fully remotely as smooth and identified relatively few challenges.
In 16 of the 20 group interviews we conducted (six of eight groups of
managerial examiners and 10 of 12 groups of nonmanagerial examiners),
examiners commented that the transition to working from home was
smooth or that their prepandemic experience working remotely facilitated
the transition. Examiners of larger institutions and examiners responsible
for consumer compliance examinations generally said they had few
challenges with the transition to fully off-site examinations because before
the pandemic, they were already equipped to carry out examination work
off-site.
Examiners across the agencies generally commented on positive aspects
of remote technology tools, and examiners at two agencies identified
challenges. In all five groups of Federal Reserve examiners, three of five
35As noted previously, the Division of Supervision and Regulation developed a crisis
response framework operational plan, which it developed during the approximately 3-
month examination pause. The plan included a prioritization framework that helped guide
resource allocation according to the Reserve Banks’ and Board management’s priorities.
Page 18 GAO-22-104659 Bank Supervision
Letter
groups of FDIC examiners, and four of five groups of OCC examiners,
examiners noted that technology tools such as videoconferencing or
secure file exchange portals were helpful. In contrast, NCUA examiners in
two of the three group interviews we conducted told us they encountered
delays at the start of the pandemic when trying to obtain documents from
credit unions through the secure file exchange portal.36
Loan file reviews and remote access to smaller institutions.
Examiners noted that fully remote examinations posed some logistical
challenges for supervised entities. In particular, many smaller institutions
lacked resources or technology to provide documents, according to
examiners and officials.37 We spoke with 13 groups of examiners across
FDIC, the Federal Reserve, NCUA, and OCC that consisted of examiners
who supervised smaller institutions. In all of these groups, examiners told
us they had challenges carrying out some examination steps in
institutions that had only physical (hard copy, non-imaged) credit files or
that did not have technology capable of allowing examiners to gain
access to bank internal systems remotely to carry out examination
activities such as loan reviews or transaction testing:
· NCUA. In all three groups, examiners noted problems obtaining loan
files from credit unions. They noted that credit unions were unable to
upload documents or were hesitant to use the secure file exchange
portal. In addition, as noted previously, NCUA examiners initially had
issues with the secure portal in terms of bandwidth and accessibility.
· FDIC. In all four groups of examiners of smaller banks, examiners
noted that they faced problems obtaining access to loan documents at
some smaller institutions. Examiners stated that these problems
related to review of hard-copy, non-imaged files, as well as a lack of
access to banks’ systems.
· Federal Reserve. In two of the three groups of community and
regional bank staff (one group of nonmanagerial examiners and one
36NCUA upgraded this technology as part of its implementation in 2021 of a new
examination tracking system. Examiners we interviewed said the problems experienced
earlier in the pandemic had been resolved by the time of our interviews in November
2021.
37Before the pandemic, examination teams of smaller institutions would review paper files
during the on-site portion of the examination or access an institution’s imaged loan files
via on-site terminals. In order to accommodate a fully off-site examination during the
pandemic, smaller institutions needed on-site staff and technology resources to scan loan
files or coordinate remote access to their internal systems. Some institutions lacked staff
resources or faced technological limitations.
Page 19 GAO-22-104659 Bank Supervision
Letter
group of managerial examiners), examiners noted that institutions had
difficulty uploading documents.
· OCC. In all three groups of examiners from OCC’s Mid-size and
Community Bank Supervision group, examiners noted that regulated
institutions relying on paper files had more difficulty in uploading
requested loan documents into OCC’s secure file exchange portal
than banks with digital records.38
Regulators Took Steps to Mitigate Challenges Related to
Loan File Reviews at Smaller Institutions
In response to the challenges with loan file reviews, regulators took a
variety of steps, including the following:
Providing resources or extra time to produce documents. Some
regulators provided resources to help supervised institutions scan loan
files. For example, FDIC provided scanners or third-party contractors to
supervised institutions that needed to scan loan files. NCUA allowed
some limited contact between staff and institutions—for example,
permitting examiners to pick up documents in person. All five of the
regulators gave institutions additional time to provide documentation.
Rescheduling or delaying examinations. Regulators temporarily
delayed examinations when institutions could not provide sufficient loan
file or other documentation for examiners to assign a rating in accordance
with procedures. For example, NCUA officials said that some scheduled
examinations were delayed to allow credit unions more time to produce
loan file or other documentation. OCC also modified the timing of
examinations when banks had difficulty providing certain information
digitally, according to officials, and worked with the institution on
technology or other solutions.
Adjusting the depth of review. In instances where examiners had
challenges receiving imaged loan files, regulators adjusted the depth of
loan review or the size of samples requested for testing of transactions at
38In addition to loan file review challenges during the pandemic, examiners at more than
one regulator identified communications and training challenges. For example, NCUA
examiners said being on-site made it easier to request additional information quickly, or
made it easier to communicate informally with institution management. In addition, in one
group of examiners from CFPB and OCC and two groups of NCUA and FDIC examiners,
examiners said the virtual environment posed difficulties providing opportunities for on-
the-job training or informal communication.
Page 20 GAO-22-104659 Bank Supervision
Letter
some institutions. Regulators reduced the depth of loan reviews by
reducing the number of loans included in a review or by reducing the
volume or type of documentation reviewed. For example, at the Federal
Reserve, in some instances where institutions were determined to be
lower risk, examiners reduced the number of loans reviewed and placed
greater reliance on bank reporting, such as banks’ problem loan lists, past
due reports, or loan review and audit reports, to assess the banks’
condition. At NCUA, examiners categorized narrower or more targeted
interactions as “supervisory contacts” when examiners lacked needed
documentation. OCC reduced the sample size of transactions for testing.
According to OCC management and examiners, examiners used existing
risk-based examination review procedures to ensure that documentation
was sufficient to make a determination. Specifically, they considered the
risk profile of the entity and coordinated with examiners-in-charge and
higher-level managers when making such decisions. The additional
pandemic guidance, as noted, also was intended to ensure that
examiners understood which documentation would suffice to enable them
to complete an examination.
Regulators Analyzed Pandemic Impacts and
Four Reviewed Lessons Learned, but OCC Did
Not
Regulators Monitored Examination Information to
Understand the Effects of the Pandemic Disruption
As part of their efforts to understand and respond to the pandemic
disruption, federal banking regulators monitored metrics and information
related to the staffing and completion of examination activities.
Examiner hours and staffing. FDIC and the Federal Reserve provided
examples of how they monitored metrics related to examiner hours and
staffing to inform decisions about how to address potential staffing
challenges related to the pandemic. In mid-2020, FDIC’s Division of Risk
Management Supervision began to compare its tracking and analysis of
actual hours examiners worked each month against projected
examination hour benchmarks to identify whether hours were increasing
and determine if additional staff resources were needed. This monitoring
effort informed FDIC’s efforts to determine how many additional retired
employees FDIC needed to bring on board to help complete required
Page 21 GAO-22-104659 Bank Supervision
Letter
examinations, and it led FDIC to implement the leave buyback program to
increase available work hours from existing examination staff. Similarly,
the Federal Reserve’s Pandemic Analytics Workstream group analyzed
metrics and information related to examiner work hours and examination
activities requiring overtime. The analyses, which the group summarized
in three reports between September 2020 and February 2021, informed
decisions about how to assign appropriate staff and ensure mandated
examinations were completed. Similarly, CFPB monitored examination
staffing through monthly dashboards. These dashboards included
breakouts of examiner hours tracked by region, which enabled CFPB
supervision managers to monitor examinations and Prioritized
Assessments. NCUA also monitored examiner hours throughout the
pandemic period and adjusted staffing based on these metrics, according
to NCUA officials.
Examinations and supervisory activities. The Federal Reserve and
NCUA provided examples of how they monitored delays and changes to
supervisory activities to stay abreast of the impacts of the pandemic. The
Federal Reserve’s Pandemic Analytics Workstream group regularly
monitored which examinations were delayed as a result of the pandemic
disruption, which helped ensure the Federal Reserve was meeting
statutory requirements to complete examinations within certain time
frames.39 NCUA developed a workbook that recorded instances where
certain examination steps could not be completed and reasons why.
After the pandemic began, OCC relied on its existing systems and
procedures to understand pandemic-related impacts. For example, OCC
examiners used existing tracking systems to enter information on delays
in examinations or changes to the depth of review in a given examination,
as well as reasons for delays, according to OCC officials.
In annual reporting, four regulators commented on the pandemic’s impact
on the number of examinations and other supervisory activities
completed. For example, in the FDIC 2020 Annual Report, FDIC reported
the total number of examinations conducted and the Office of Inspector
General noted that 39 examinations were temporarily delayed in 2020
because of pandemic disruptions. In addition, in its winter 2021
Supervisory Highlights Special Edition, CFPB reported that in May 2020 it
rescheduled approximately half of its planned examination work and
39As noted previously, the Federal Reserve is required to conduct full-scope safety and
soundness examinations and compliance examinations within certain statutorily mandated
time frames.
Page 22 GAO-22-104659 Bank Supervision
Letter
instead conducted Prioritized Assessments. Appendix II contains more
information about the number of examinations and other supervisory
activities completed by each regulator in 2020 and 2021.
Four Agencies Took Steps to Review Lessons Learned
from the Pandemic, While OCC Has Not Fully Done So
Post-crisis assessments of performance to identify lessons learned can
help agencies develop strategies for future disruptions. In relation to the
pandemic disruption, conducting a lessons-learned review can help the
banking regulators evaluate their responses to pandemic-related
challenges and identify areas to improve off-site examinations in the
future or better prepare for future disruptions. We have previously
identified practices that federal agencies can use to identify and apply
lessons learned—a systematic means for agencies to learn from an event
and make decisions about when and how to use that knowledge to
change behavior.40 Among the GAO-identified practices for identifying
and applying lessons learned are
· collecting information, such as through interviews with relevant
stakeholders;
· analyzing information collected to determine root causes of positive or
negative experiences and identify appropriate actions; and
· disseminating or sharing the lessons, such as through briefings or
reports.
As of June 2022, three of the regulators—the Federal Reserve, FDIC,
and NCUA—had conducted reviews of their response to the COVID-19
pandemic with regard to bank supervision that reflected GAO-identified
practices. Key examples of how these agencies collected, analyzed, and
shared lessons learned include the following:
· Federal Reserve. In January and February 2022, the Federal
Reserve’s Pandemic Analytics Workstream group completed a report
and memorandum that outlined its findings from collecting and
analyzing data related to how the Federal Reserve managed staffing
resources and workloads to meet examination goals and other
requirements during the pandemic. In addition, in the internal
40GAO-12-901. To develop these practices related to lessons learned, we reviewed
analyses of prior GAO lessons-learned work, external lessons-learned processes, agency
interviews, and relevant literature. For more information on our methodology, see app. I.
Page 23 GAO-22-104659 Bank Supervision
Letter
memorandum, this group shared lessons learned with Federal
Reserve management on ways to improve future crisis responses,
such as specific steps to ensure that the Federal Reserve maintains
and strengthens its data analytics capabilities.
· FDIC. In August 2020, FDIC’s Coronavirus Working Group convened
a meeting of representatives from across the agency to discuss
participants’ perspectives on strengths and potential areas for
improvement regarding FDIC’s actions to respond to the pandemic in
areas such as information technology, leadership communication,
telework policies, and training. The group issued a report that
identified opportunities for improvement related to leadership
communication, telework policies, and other areas. In addition, from
January through September 2021, FDIC’s divisions of Risk
Management Supervision and Depositor and Consumer Protection
carried out lessons-learned activities that included 12 focus groups of
examiners and collection of written feedback from headquarters and
field offices. FDIC staff from these divisions analyzed input from
examination staff and developed 37 recommendations for improving
virtual examinations.41
· NCUA. In January 2022, NCUA completed a report that shared the
results of its review of lessons learned from operating in a nearly fully
off-site examination posture during the pandemic. The report outlined
the results of NCUA’s analysis of pandemic impacts in areas such as
examination duration, the extent to which certain examination steps
were not completed, communication practices, and technology
challenges, among other issues. The report identified next steps for
incorporating lessons learned in areas such as using new and
emerging data, increasing use of innovative technology, and
adjustments in supervisory approaches.
CFPB is collecting and analyzing information about its pandemic
experience and plans to share the results with supervision leadership by
winter 2023, according to CFPB officials. The Office of Supervision,
Enforcement, and Fair Lending began an effort in January 2021 called
“the Future of Travel” to identify and incorporate key lessons learned from
the shifting of more examination activities off-site, which CFPB staff told
us was the most significant pandemic-related effect on CFPB’s
41In addition to these lessons-learned reviews, the Federal Reserve and FDIC took steps
to collect and analyze input from supervised institutions on their supervision processes in
light of the pandemic disruption. The Federal Reserve’s Ombudsman conducted outreach
to institutions supervised by the Federal Reserve, and FDIC collected input from
supervised institutions through a Request for Information published in the Federal
Register.
Page 24 GAO-22-104659 Bank Supervision
Letter
supervisory work. CFPB provided two slide presentations that included
steps such as establishing two working groups of examination managers
to review pandemic experiences of fully remote examinations and
determine how to resume on-site examinations efficiently. The effort also
included piloting a voluntary on-site examination model to explore the
effectiveness of expanding off-site examination processes. The
information collected from these activities will be evaluated and
recommendations are to be shared with supervision leadership and staff,
according to CFPB officials.
As of June 2022, OCC had not undertaken or planned steps to assess
and share lessons learned from its actions to respond to the pandemic
disruption. According to OCC officials, OCC has not conducted a lessons-
learned effort because its real-time monitoring during the pandemic
provided it with the necessary information to assess the impact of the
pandemic on examinations. Although OCC examiners encountered
pandemic-related challenges similar to those of other regulators in
carrying out their responsibilities, OCC did not collect, analyze, or
disseminate information to learn lessons from examiners’ experiences.
Collecting and analyzing information on key aspects of its pandemic
response could better position OCC to identify strengths and potential
areas for improvement with respect to its off-site examination approaches
and future crisis responses.
Conclusions
In spring 2020, federal banking regulators acted quickly to respond to the
risks and challenges COVID-19 posed to their supervisory missions,
including by expanding use of off-site monitoring tools and supporting
examiners conducting fully remote examinations. All five regulators
recognized the benefits of incorporating pandemic-related risks into their
ERM frameworks as part of an enterprise-wide approach to identifying
and assessing risks that could affect the achievement of goals. Four of
the regulators have updated key elements of their ERM frameworks to
account for pandemic-related risks. While Federal Reserve officials said
the agency plans to take similar action as part of its efforts to develop an
ERM framework, the agency did not have specific action steps or time
frames for doing so as of June 2022. As the Federal Reserve continues
the work it began in 2017 to complete an ERM framework, incorporating
consideration of pandemic-related risks to supervision into this framework
would help ensure it is well positioned to respond to future crisis
disruptions to its supervision activities.
Page 25 GAO-22-104659 Bank Supervision
Letter
Use of lessons learned is a principal component of an organizational
culture committed to continuous improvement. The Federal Reserve,
FDIC, NCUA, and CFPB each completed or have begun lessons-learned
activities to identify actions that will help them better manage future
disruptions to on-site examination work. In contrast, OCC has not
reviewed lessons learned in areas that presented challenges in
conducting fully remote examinations. Undertaking efforts to review
potential lessons learned would better position OCC to prepare for future
crisis events that disrupt the agency’s supervision work.
Recommendations for Executive Action
We are making two recommendations, one each to the Federal Reserve
and OCC:
The Federal Reserve’s Chief Operating Officer should develop and
document specific action steps and time frames for completing the
components of the Federal Reserve’s enterprise risk management
framework related to identifying and assessing risks to its supervisory
mission, such as those caused by the COVID-19 pandemic.
(Recommendation 1)
OCC’s Senior Deputy Comptrollers of Large Bank Supervision and Mid-
Size and Community Bank Supervision should review potential lessons
learned related to how OCC managed adjustments to supervisory
activities during the COVID-19 pandemic. This review should include
collection and analysis of information to identify aspects of fully remote
examinations that worked well and areas for improvement.
(Recommendation 2)
Agency Comments and Our Evaluation
We provided a draft of this report to CFPB, FDIC, the Federal Reserve,
NCUA, and OCC for review and comment. The Federal Reserve, NCUA,
and OCC provided written comments, which are reproduced in
appendixes III, IV, and V, respectively. In addition, all five agencies
provided technical comments, which we incorporated as appropriate.
In its written comments, the Federal Reserve neither agreed nor
disagreed with our first recommendation, stating that it recognizes the
importance of effectively identifying, assessing, and managing risks to its
Page 26 GAO-22-104659 Bank Supervision
Letter
supervisory mission. It further stated that it will continue to develop an
enterprise risk management framework that will provide a strategic view
for comprehensively managing all material risks faced by the Federal
Reserve, including pandemic-related risks. We maintain that documenting
planned steps and time frames for developing specific supervision-related
ERM elements would help to ensure timely completion of its ERM
framework and would ensure the Federal Reserve is prepared to manage
future disruptions to examinations.
In regard to our second recommendation, OCC stated that it plans to
complete a lessons learned analysis related to how it managed
adjustments to supervisory activities during the COVID-19 pandemic.
OCC further stated that its analysis will include the collection of relevant
examination data and an analysis of a sample of fully remote
examinations, as appropriate, conducted during 2020 and 2021 to identify
best practices and recommended improvements. OCC expects to
complete this analysis by March 2023.
We are sending copies of this report to the appropriate congressional
committees, the Director of the Consumer Financial Protection Bureau,
Acting Chairman of the Board of Directors of the Federal Deposit
Insurance Corporation, Chair of the Board of Governors of the Federal
Reserve System, Chairman of the National Credit Union Administration,
Acting Comptroller of the Currency, and interested parties. In addition, the
report is available at no charge on the GAO website at
https://www.gao.gov.
If you or your staff have any questions about this report, please contact
me at (202) 512-8678 or clementsm@gao.gov. Contact points for our
Offices of Congressional Relations and Public Affairs are listed on the last
page of this report. GAO staff who made major contributions to this report
are listed in appendix VI.
Michael E. Clements
Director, Financial Markets and Community Investment
Page 27 GAO-22-104659 Bank Supervision
Letter
List of Committees
The Honorable Patrick Leahy
Chairman
The Honorable Richard Shelby
Vice Chairman
Committee on Appropriations
United States Senate
The Honorable Patrick Toomey
Ranking Member
Senate Committee on Banking, Housing, and Urban Affairs
United States Senate
The Honorable Ron Wyden
Chairman
The Honorable Mike Crapo
Ranking Member
Committee on Finance
United States Senate
The Honorable Patty Murray
Chair
The Honorable Richard Burr
Ranking Member
Committee on Health, Education, Labor, and Pensions
United States Senate
The Honorable Gary C. Peters
Chairman
The Honorable Rob Portman
Ranking Member
Committee on Homeland Security and Governmental Affairs
United States Senate
The Honorable Rosa L. DeLauro
Chair
The Honorable Kay Granger
Ranking Member
Committee on Appropriations
House of Representatives
Page 28 GAO-22-104659 Bank Supervision
Letter
The Honorable Frank Pallone, Jr.
Chairman
The Honorable Cathy McMorris Rodgers
Republican Leader
Committee on Energy and Commerce
House of Representatives
The Honorable Bennie G. Thompson
Chairman
The Honorable John Katko
Ranking Member
Committee on Homeland Security
House of Representatives
The Honorable Carolyn B. Maloney
Chairwoman
The Honorable James Comer
Ranking Member
Committee on Oversight and Reform
House of Representatives
The Honorable Richard Neal
Chairman
The Honorable Kevin Brady
Republican Leader
Committee on Ways and Means
House of Representatives
Page 29 GAO-22-104659 Bank Supervision
Appendix I: Objectives, Scope, and
Methodology
Appendix I: Objectives,
Scope, and Methodology
This report examines (1) how federal banking regulators identified and
assessed risks and challenges the pandemic posed to their supervisory
missions, (2) adjustments they made to examination activities to address
key risks and challenges, and (3) steps they have taken to monitor the
effects of pandemic-related changes and identify lessons learned from
their responses to the pandemic disruption to on-site examinations. The
agencies that examine depository institutions are the Consumer Financial
Protection Bureau (CFPB), Federal Deposit Insurance Corporation
(FDIC), Board of Governors of the Federal Reserve System (Federal
Reserve), National Credit Union Administration (NCUA), and Office of the
Comptroller of the Currency (OCC).1
To address the first objective, we reviewed documentation of risk
management efforts within each agency’s divisions of supervision and
interviewed staff and management within those divisions about steps they
took to identify risks to examinations during the pandemic. We then
categorized the common risks and challenges the regulators faced in
carrying out examinations during the pandemic. We also reviewed
documentation of agencies’ enterprise risk management (ERM)
frameworks and other risk management components and interviewed
officials responsible for risk management at each of the five agencies
about their risk management efforts during the pandemic. We reviewed
how the agencies’ ERM programs were structured, reviewed ERM
elements, and compared agencies’ implementation of their ERM
programs to their own guidance, as well as Office of Management and
1The 12 Federal Reserve banks that are part of the Federal Reserve System carry out
Federal Reserve core functions, including supervising and examining banks that are state
chartered and are members of the Federal Reserve System and bank and thrift holding
companies. Federal Reserve Banks also supervise nonbank financial institutions that have
been designated as systemically important under authority delegated to them by the
Federal Reserve Board. The Securities and Exchange Commission and Commodity
Futures Trading Commission also have financial oversight responsibilities, which were
outside the scope of this review.
Page 30 GAO-22-104659 Bank Supervision
Appendix I: Objectives, Scope, and
Methodology
Budget (OMB) guidance on implementing ERM in federal agencies.2
Specifically, we compared agencies’ ERM programs and their updates of
ERM elements against OMB Circular A-123 guidance, which
recommends updating ERM elements such as risk profiles to reflect
changes in risks.
To address the second objective, we reviewed documentation of
agencies’ actions to address pandemic risks and challenges, such as
agency policies, procedures, and internal guidance and communications
provided to examiner staff. We interviewed officials in agency divisions
with bank supervision responsibilities about how they managed
challenges such as those related to conducting examinations remotely.
We categorized the changes agencies made to address the challenges
identified in our first objective.
We also conducted group interviews with a nongeneralizable selection of
examination staff at each agency to understand examiners’ experiences
with conducting examinations during the pandemic and their experiences
with the changes to examination processes. In total, we conducted 20
small group interviews of between four and 10 examiners from each of
the five agencies (a total of 110 examiners). We conducted two group
interviews with CFPB, three group interviews with NCUA, and five group
interviews each with FDIC, Federal Reserve, and OCC staff. The
distribution of examiners with managerial and nonmanagerial roles and by
agency is listed in table 4.
2Office of Management and Budget, Management’s Responsibility for Enterprise Risk
Management and Internal Control, OMB Circular A-123 (Washington, D.C.: July 15, 2016).
Although the financial regulators are not necessarily required to adhere to OMB guidance,
agencies with ERM frameworks, including CFPB and FDIC, have voluntarily opted to
follow OMB guidance on ERM.
Page 31 GAO-22-104659 Bank Supervision
Appendix I: Objectives, Scope, and
Methodology
Table 4: Number of Agency Examination Staff Interviewed about Pandemic Experiences
Number of groups Number of Number of groups of Number of Total
of managerial managerial nonmanagerial nonmanagerial number of
Regulator examiners examiners examiners examiners examiners
Consumer Financial 1 4 1 5 9
Protection Bureau
Federal Deposit 2 11 3 20 31
Insurance Corporation
Board of Governors of 2 11 3 21 32
the Federal Reserve
System
National Credit Union 1 4 2 9 13
Administration
Office of the 2 11 3 14 25
Comptroller of the
Currency
Total 8 41 12 69 110
Source: GAO analysis. | GAO-22-104659
Note: Managerial examiners are examination staff who supervise teams of examiners; nonmanagerial
examiners are examination staff who carry out examination activities directly with supervised
institutions.
For each agency, using agency work force data, we established a
population of examination staff who manage teams of examiners and a
population of nonmanagerial examination staff. Managerial examiners are
examination staff who supervise teams of examiners; nonmanagerial
examiners are examination staff who carry out examination activities
directly with supervised institutions. To ensure our populations were
randomized, we generated a random value for each individual in each
agency’s workforce populations and then sorted the lists from smallest to
largest. From those populations we narrowed the selection to groups of
no fewer than four and no more than 10 examiners each. The number of
examiners in each group varied because some examiners were
unavailable for any of the dates and times we scheduled the discussions.
To ensure a broad range of views, we judgmentally selected the
examiners to represent a range of positions, responsibilities, and regional
locations. We selected examiners who conduct safety and soundness
examinations, compliance examinations, or specialty examinations at
each agency that conducts such examinations. For FDIC, the Federal
Reserve, and OCC, we selected groups of examiners who primarily
supervise large institutions and groups of examiners of smaller
community and regional institutions. Group interviews took place using
Page 32 GAO-22-104659 Bank Supervision
Appendix I: Objectives, Scope, and
Methodology
teleconference lines, with the exception of NCUA, for which we used
videoconference technology.
Our interviews focused on three topics: (1) benefits and challenges of
conducting examination responses remotely, (2) adjustments to
examination practices as a result of the pandemic, and (3) additional
steps agencies could take to strengthen their ability to execute
supervision responsibilities during a pandemic or other disruption. As the
sample was nongeneralizable, the views of the staff we spoke with are
not generalizable to all examination staff within each agency.
To address the third objective, we reviewed agency reports, slide
presentations, and other documentation of agencies’ efforts to monitor
and analyze data to understand pandemic impacts on their bank
supervision work, such as changes to examination hours, duration,
staffing, and other indicators. In addition, we reviewed agencies’ public
and internal data and their analyses of the number of examinations
conducted during the pandemic. To assess the reliability of the data, we
reviewed related documentation and interviewed knowledgeable staff at
the agencies and identified any outliers. We concluded that applicable
data were sufficiently reliable for the purpose of reporting aggregate
annual examination numbers.
We also reviewed documentation, including analyses and internal reports,
the regulators developed to monitor and analyze the impact of changes
they made to their examinations in response to the pandemic. For
example, we reviewed internal reports, dashboards, and analyses of
examination staffing and scheduling, and workbooks or other information
about changes to the depth of review of examinations. We also compared
agencies’ actions to one another to identify types of analyses that were
common across agencies, and we interviewed staff and officials to learn
the reasons for any differences. We interviewed managers of the
agencies’ supervision divisions to understand how they used these
analyses. We also interviewed representatives from the American
Bankers Association and the Independent Community Bankers
Association to obtain their perspectives on regulators’ oversight activities.
Finally, we gathered and analyzed reports, analyses, and retrospective
reviews agencies conducted about their pandemic experiences and
interviewed staff and officials at each regulator about lessons-learned
activities and how they plan to use the findings from these analyses to
prepare for future disruptions to on-site examinations. We compared their
Page 33 GAO-22-104659 Bank Supervision
Appendix I: Objectives, Scope, and
Methodology
lessons-learned efforts to GAO-identified practices for identifying and
applying lessons learned.3
We conducted this performance audit from March 2021 to September
2022 in accordance with generally accepted government auditing
standards. Those standards require that we plan and perform the audit to
obtain sufficient, appropriate evidence to provide a reasonable basis for
our findings and conclusions based on our audit objectives. We believe
that the evidence obtained provides a reasonable basis for our findings
and conclusions based on our audit objectives.
3GAO, Federal Real Property Security: Interagency Security Committee Should Implement
a Lessons-Learned Process, GAO-12-901 (Washington, D.C.: Sept. 10, 2012). To
develop these key practices related to lessons learned, we reviewed analyses of prior
GAO lessons-learned work, external lessons-learned processes, agency interviews, and
relevant literature. See also other recent GAO work, which applied GAO lessons-learned
practices to selected actions at other agencies: GAO, Federal Hiring: OPM Should Collect
and Share COVID-19 Lessons Learned to Inform Hiring during Future Emergencies,
GAO-22-104297 (Washington, D.C.: Oct. 25, 2021); DOD Utilities Privatization: Improved
Data Collection and Lessons Learned Archive Could Help Reduce Time to Award
Contracts, GAO-20-104 (Washington, D.C.: Apr. 2, 2020); and Project Management: DOE
and NNSA Should Improve Their Lessons-Learned Process for Capital Asset Projects,
GAO-19-25 (Washington, D.C.: Dec. 21, 2018).
Page 34 GAO-22-104659 Bank Supervision
Appendix II: Examinations by Federal Banking
Regulators, 2016–2021
Appendix II: Examinations by
Federal Banking Regulators,
2016–2021
Federal Prudential Banking Regulators
The four federal prudential banking regulators are the Federal Deposit
Insurance Corporation (FDIC), the Board of Governors of the Federal
Reserve System (Federal Reserve), the National Credit Union
Administration (NCUA), and the Office of the Comptroller of the Currency
(OCC). Among other oversight responsibilities, these regulators conduct
examinations and other types of reviews of depository institutions under
their authority to ensure safety and soundness and compliance with
consumer laws, among other purposes.1
Each regulator counts its examinations differently but the number of
examinations each regulator carried out declined in 2020, the year in
which the COVID-19 pandemic began. For FDIC, the number of
examinations also declined in calendar year 2021.2 For OCC and NCUA,
1FDIC, the Federal Reserve, and OCC are required under provisions of the Federal
Deposit Insurance Act to conduct a full-scope safety and soundness examination of each
insured depository institution they supervise at least once during each 12-month period.
12 U.S.C. §1820(d)(1). Under the Federal Credit Union Act, NCUA conducts examinations
of credit unions. 12 U.S.C. §§ 1756, 1784. These regulators can extend the cycle based
on certain conditions. The 12 Federal Reserve Banks that are part of the Federal Reserve
System carry out Federal Reserve core functions, including supervising and examining
banks that are state chartered and that are members of the Federal Reserve System and
bank and thrift holding companies. The Federal Reserve Banks also supervise nonbank
financial institutions that have been designated as systemically important under authority
delegated to them by the Federal Reserve Board.
2FDIC officials said that declines were due to a decrease in the number of institutions
under supervision and an increase in the number of banks eligible for the 18-month
examination cycle.
Page 35 GAO-22-104659 Bank Supervision
Appendix II: Examinations by Federal Banking
Regulators, 2016–2021
the number of examinations increased in 2021 to be above the
prepandemic level.3
The COVID-19 pandemic contributed to a decline in the number of
examinations in 2020 at some agencies by causing delays in scheduling
of examinations and increasing the time needed to complete certain
examination tasks. Prior to the pandemic, the number of examinations
carried out per year had been declining because of factors such as
consolidation in the banking industry and legislative changes that raised
the asset threshold of banks eligible for an 18-month examination cycle
from $1 billion to $3 billion.4
Figures 2–5 show trends in examination activity by the four prudential
regulators.
3NCUA reviews increased in 2021 primarily because of an increase in off-site contacts to
facilitate data transfer to NCUA’s new Modern Examination and Risk Identification Tool,
known as MERIT. OCC staff said examinations fluctuate from year to year based on
OCC’s standard risk-based approach to examination planning.
4Economic Growth, Regulatory Relief, and Consumer Protection Act, Pub. L. No. 115-174,
§ 210(1), 132 Stat. 1296, 1316 (2018). According to a 2020 FDIC study, between year-
end 2011 and year-end 2019, the overall number of banks dropped from 7,357 to 5,177,
representing a decline of nearly 30 percent.
Page 36 GAO-22-104659 Bank Supervision
Appendix II: Examinations by Federal Banking
Regulators, 2016–2021
Figure 2: Number of FDIC Examinations of Insured Depository Institutions, 2016–
2021
Year Exams
2016 6892
2017 6393
2018 6041
2019 5875
2020 5399
2021 5199
Note: Includes examinations to ensure safety and soundness and compliance with consumer and
other laws, as well as other specialty examinations, of state-chartered banks and thrifts that are not
members of the Federal Reserve System.
Page 37 GAO-22-104659 Bank Supervision
Appendix II: Examinations by Federal Banking
Regulators, 2016–2021
Figure 3: Number of Federal Reserve Examinations of Depository Institutions That
Are Members of the Federal Reserve System, 2016–2021
2016 2017 2018 2019 2020 2021
Total Exams 988 954 945 939 655 762
Note: Includes examinations to ensure safety and soundness and compliance with consumer and
other laws, as well as specialty examinations, of state-chartered banks and thrifts that are members
of the Federal Reserve System. Specialty examinations include fiduciary activities, transfer agent
activities, government and municipal securities dealers, and Securities Credit Lenders (Regulation U);
they do not include specialty examinations related to information technology, cybersecurity, and
capital planning examinations and bank holding company inspections. The Federal Reserve paused
most examination activities between March and June 2020 for institutions under $100 billion in
assets. Most of these examinations were rescheduled for later in 2020, but some were rescheduled
for 2021 or later. The 12 Federal Reserve Banks that are part of the Federal Reserve System carry
out Federal Reserve core functions, including supervising and examining banks that are state
chartered and that are members of the Federal Reserve System and bank and thrift holding
companies. The Federal Reserve Banks also supervise nonbank financial institutions that have been
designated as systemically important under authority delegated to them by the Federal Reserve
Board.
Page 38 GAO-22-104659 Bank Supervision
Appendix II: Examinations by Federal Banking
Regulators, 2016–2021
Figure 4: Number of NCUA Examinations, 2016–2021
Year Exams
2016 9465
2017 6024
2018 5571
2019 5035
2020 4176
2021 5244
Note: Includes on-site examinations as well as supervisory contacts of federally insured credit unions
and joint examinations of federally insured state-chartered credit unions. A supervisory contact is an
off-site review of the institution. Because most examinations as well as supervisory contacts took
place off-site in 2020 and 2021, NCUA officials said that supervisory contacts during this period
included narrower, targeted reviews.
Page 39 GAO-22-104659 Bank Supervision
Appendix II: Examinations by Federal Banking
Regulators, 2016–2021
Figure 5: Number of OCC Examinations, 2016–2021
Year Exams
2016 4793
2017 7124
2018 8671
2019 10294
2020 9931
2021 10363
Note: Includes examinations to ensure safety and soundness and compliance and specialty
examinations of national banks and savings and loan associations that are federally chartered. OCC
examination data we reviewed categorized examinations as either “ongoing” or “targeted.” In a given
examination cycle, OCC may conduct several ongoing and targeted reviews for each supervised
institution.
Consumer Financial Protection Bureau
The Consumer Financial Protection Bureau (CFPB) conducts
examinations and targeted reviews of institutions under its supervisory
authority to assess compliance with federal consumer financial law,
obtain information about compliance management systems, and detect
and assess risks to consumers and markets for consumer financial
products and services. Institutions under CFPB’s supervisory authority
include insured depository institutions and insured credit unions with
Page 40 GAO-22-104659 Bank Supervision
Appendix II: Examinations by Federal Banking
Regulators, 2016–2021
assets of more than $10 billion, their affiliates, and certain nondepository
entities.5
In May 2020, CFPB began using a new supervisory tool called “Prioritized
Assessments” to focus on entities operating in markets that pose elevated
risks of consumer harm resulting from the pandemic (see fig. 6).
Prioritized Assessments had a narrower period of review and scope than
traditional examinations and were intended to identify potential risks of
violations and determine whether follow-up work by CFPB was
necessary. CFPB deferred several planned examinations and targeted
reviews and instead conducted Prioritized Assessments, which caused
the number of examinations and targeted reviews completed by CFPB to
decline in 2020, according to CFPB officials.
5CFPB has supervisory authority over nonbank financial institutions, including payday
lenders, student loan originators, and nonbank mortgage originators and servicers. CFPB
also supervises larger participants in other consumer financial markets (as defined by
CFPB rules), in consumer reporting, consumer debt collection, student loan servicing,
international money transfer, and automobile financing. CFPB recently announced it had
begun to use its authority to supervise nonbanks whose activities CFPB had “reasonable
cause to determine” posed risks to consumers. See 12 U.S.C. § 5514(a)(1)(C).
Page 41 GAO-22-104659 Bank Supervision
Appendix II: Examinations by Federal Banking
Regulators, 2016–2021
Figure 6: Number of CFPB Examinations, Targeted Reviews, and Prioritized
Assessments, 2019–2021
2019 2020 2021
Total CFPB Exams 133 417 260
PAs 312 150
Targeted reviews 133 105 110
Note: Includes CFPB examinations and targeted reviews for compliance with federal consumer
financial laws as well as Prioritized Assessments of depository institutions and nonbank financial
service providers (e.g., mortgage originators and servicers, payday lenders, student loan originators,
consumer reporting, debt collection, auto finance origination and servicing, student loan servicing,
and international money transfers). In May 2020, CFPB began using a new supervisory tool called
“Prioritized Assessments.” Prioritized Assessments were reviews that focused on assessing how
supervised entities operating in the riskiest sectors responded to COVID-19-related risks to
consumers. In 2020 and 2021, CFPB rescheduled some planned examinations and targeted reviews
in order to conduct Prioritized Assessments.
Page 42 GAO-22-104659 Bank Supervision
Appendix III: Comments from the Board of
Governors of the Federal Reserve System
Appendix III: Comments from the Board of
Governors of the Federal Reserve System
Page 43 GAO-22-104659 Bank Supervision
Appendix III: Comments from the Board of
Governors of the Federal Reserve System
Page 44 GAO-22-104659 Bank Supervision
Appendix III: Comments from the Board of
Governors of the Federal Reserve System
Agency Comment Letter
Text of Appendix III: Comments from the Board of Governors of the
Federal Reserve System
July 28, 2022
Michael Clements
Director
Financial Markets and Community Investment
United States Government Accountability Office
441 G Street, NW
Washington, DC 20548
Dear Mr. Clements:
Thank you for providing the Board of Governors of the Federal Reserve System
(“Board”) with an opportunity to review the final draft of the Government
Accountability Office (“GAO”) report titled: Bank Supervision: Lessons Learned from
Remote Supervision during Pandemic Could Inform Future Disruptions (GAO-22-
104659). The GAO’s report examines how federal banking regulators identified and
responded to risks and challenges the pandemic posed to their supervisory missions,
as well as steps the regulators have taken to identify lessons learned from their
responses to the pandemic-related disruptions to on-site examinations. We
appreciate the report’s recognition of the Board’s actions to manage pandemic-
related risks and challenges to its supervisory mission, as well as the efforts
undertaken by the Board to analyze lessons learned since the start of the pandemic.
The GAO’s report makes one recommendation to the Board (which the GAO’s report
refers to as the “Federal Reserve”):
The Federal Reserve’s Chief Operating Officer should develop and document
specific action steps and timeframes for completing the components of the Federal
Reserve’s enterprise risk management framework related to identifying and
assessing risks to its supervision mission, such as those caused by the COVID-19
pandemic.
The Board recognizes the importance of effectively identifying, assessing, and
managing risks to its supervisory mission. As such, the Board continues to develop
an enterprise risk management framework that will provide a strategic view for
Page 45 GAO-22-104659 Bank Supervision
Appendix III: Comments from the Board of
Governors of the Federal Reserve System
comprehensively managing all material risks faced by the Board, including
pandemic-related risks.
We appreciate the GAO’s review of the federal banking regulators’ response to the
pandemic, for their professional approach to the review, and for the opportunity to
comment.
Sincerely,
Pat McClanahan
Page 46 GAO-22-104659 Bank Supervision
Appendix IV: Comments from the National
Credit Union Administration
Appendix IV: Comments from the
National Credit Union Administration
Page 47 GAO-22-104659 Bank Supervision
Appendix IV: Comments from the National
Credit Union Administration
Agency Comment Letter
Text of Appendix IV: Comments from the National Credit Union
Administration
August 1, 2022
Michael E. Clements
Director, Financial Markets & Community Investment
U.S. Government Accountability Office
441 G Street NW
Washington, DC 20548
Dear Mr. Clements,
We reviewed GAO’s draft report (GAO-22-104659) titled Bank Supervision: Lessons
Learned from Remote Supervision during Pandemic Could Inform Future
Disruptions. We acknowledge GAO’s observations and appreciate the information in
the report.
Thank you for the opportunity to review and comment on the draft report.
Sincerely,
Larry Fazio
Executive Director
Page 48 GAO-22-104659 Bank Supervision
Appendix V: Comments from the Office of the
Comptroller of the Currency
Appendix V: Comments from the Office of
the Comptroller of the Currency
Page 49 GAO-22-104659 Bank Supervision
Appendix V: Comments from the Office of the
Comptroller of the Currency
Agency Comment Letter
Text of Appendix V: Comments from the Office of the Comptroller
of the Currency
August 3, 2022
Mr. Michael E. Clements
Director, Financial Markets and Community Investment
U. S. Government Accountability Office
Washington, DC 20548
Dear Mr. Clements:
Thank you for providing the Office of the Comptroller of the Currency (OCC) an
opportunity to review the Government Accountability Office’s (GAO) draft report titled
Bank Supervision: Lessons Learned from Remote Supervision during Pandemic
Could Inform Future Disruptions (GAO-22-104659). Technical edits have been
provided separately.
As part of this review, the GAO has provided the following recommendation:
OCC’s Senior Deputy Comptrollers of Large Bank Supervision and Mid-Size and
Community Bank Supervision should review potential lessons learned related to how
OCC managed adjustments to supervisory activities during the COVID-19 pandemic.
This review should include collection and analysis of information to identify aspects
of fully remote examinations that worked well and areas for improvement.
To address this recommendation, the OCC plans to complete a lessons learned
analysis related to how the OCC managed adjustments to supervisory activities
during the COVID-19 pandemic.
The analysis will include the collection of relevant examination data and an analysis
of a sample of fully remote examinations, as appropriate, conducted during 2020 and
2021 to identify best practices and recommended improvements. The OCC’s
analysis will be completed by March 31, 2023.
If you need additional information, please contact Rosalie Bair, at (202) 286-1682.
Sincerely,
Page 50 GAO-22-104659 Bank Supervision
Appendix V: Comments from the Office of the
Comptroller of the Currency
Gregory Coleman
Senior Deputy Comptroller for Large Bank Supervision
Page 51 GAO-22-104659 Bank Supervision
Appendix VI: Contacts and Staff
Acknowledgments
Appendix VI: Contacts and
Staff Acknowledgments
GAO Contact
Michael E. Clements at (202) 512-8678 or clementsm@gao.gov
Staff Acknowledgments
In addition to the contact named above, John Fisher (Assistant Director),
Catherine Gelb (Analyst in Charge), M’Baye Diagne, Genesis Galo, John
McGrail, Marc Molino, Will Reeves, Jennifer Schwartz, Farrah Stone, and
Leanne Violette made key contributions to this report.
(104659)
Page 52 GAO-22-104659 Bank Supervision
GAO’s Mission
The Government Accountability Office, the audit, evaluation, and investigative
arm of Congress, exists to support Congress in meeting its constitutional
responsibilities and to help improve the performance and accountability of the
federal government for the American people. GAO examines the use of public
funds; evaluates federal programs and policies; and provides analyses,
recommendations, and other assistance to help Congress make informed
oversight, policy, and funding decisions. GAO’s commitment to good government
is reflected in its core values of accountability, integrity, and reliability.
Obtaining Copies of GAO Reports and Testimony
The fastest and easiest way to obtain copies of GAO documents at no cost is
through our website. Each weekday afternoon, GAO posts on its website newly
released reports, testimony, and correspondence. You can also subscribe to
GAO’s email updates to receive notification of newly posted products.
Order by Phone
The price of each GAO publication reflects GAO’s actual cost of production and
distribution and depends on the number of pages in the publication and whether
the publication is printed in color or black and white. Pricing and ordering
information is posted on GAO’s website, https://www.gao.gov/ordering.htm.
Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537.
Orders may be paid for using American Express, Discover Card, MasterCard,
Visa, check, or money order. Call for additional information.
Connect with GAO
Connect with GAO on Facebook, Flickr, Twitter, and YouTube.
Subscribe to our RSS Feeds or Email Updates. Listen to our Podcasts.
Visit GAO on the web at https://www.gao.gov.
To Report Fraud, Waste, and Abuse in Federal
Programs
Contact FraudNet:
Website: https://www.gao.gov/about/what-gao-does/fraudnet
Automated answering system: (800) 424-5454 or (202) 512-7700
Congressional Relations
A. Nicole Clowers, Managing Director, ClowersA@gao.gov, (202) 512-4400, U.S.
Government Accountability Office, 441 G Street NW, Room 7125, Washington,
DC 20548
Public Affairs
Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800
U.S. Government Accountability Office, 441 G Street NW, Room 7149
Washington, DC 20548
Strategic Planning and External Liaison
Stephen J. Sanford, Managing Director, spel@gao.gov, (202) 512-4707
U.S. Government Accountability Office, 441 G Street NW, Room 7814,
Washington, DC 20548
File and source
- File
- gao-22-104659.pdf
- Size
- 3,092,579 bytes
- SHA-256
- 0916cda427b6e5e80b918cdedcbf77086bf4a4fb8f98cceeb2667cf76c58a99b
- Our copy
- gao-22-104659.pdf
- Original
- www.gao.gov