Every regulated institution meets its examiners eventually. In banking that means the OCC, the Fed, the FDIC, or a state supervisor, and they arrive with a question that sounds almost too plain to worry about: do your controls operate the way your documents say they do?
Sit with that question for a minute, because it is the whole examination. A policy describes a control. An exam tests whether the control runs. Findings live in the gap between the two, and most of what passes for “exam readiness” is a frantic ninety-day effort to close that gap before the visit. The institutions that examine well never let the gap open in the first place.
I’ve spent about two decades in banking technology, enough time to watch this cycle from several angles. What follows is the short list of operating habits I’ve seen hold up.
Measure risk as one number people can move
Risk measurement usually fails in one of two ways. Either you get the forty-tile dashboard nobody reads, or the annual heat map nobody believes. What actually works is duller than either: a single composite score (vulnerability severity, weighted by asset criticality and by how long the exposure has been sitting there), trended weekly, and visible to everyone from the engineer to the CIO. Whether the formula is clever matters much less than whether the number has an audience every week. Risk measurement is a management system. Treat it like an analytics project and it dies in a deck.
Give every finding a date, and have someone independent sign it
There’s a reason the three-lines model exists. When the team that owns the work also grades its own remediation plan, dates drift. Nobody is lying; everyone is just optimistic. So: every finding gets an action plan with a date, and a second line that doesn’t report to the people doing the work endorses that plan before it becomes the record. Examiners read aged findings the way a doctor reads vital signs. A finding that has been open for a year with no endorsed plan tells them more than any policy binder can tell them in your favor.
Treat hygiene as a service level
Patch currency. Configuration drift. Systems past end of life. Examiners keep returning to these fundamentals for the same reason attackers do. The institutions that hold the line define patch cadence as an explicit service level, measure it continuously, and treat a miss the way operations treats a missed availability target: as an incident with a cause. Something useful happens when hygiene is framed this way. It inherits the legitimacy that uptime already has. Nobody in an ops review debates whether uptime matters, and after a while nobody debates the patch SLA either.
Report on a rhythm
If risk posture reaches leadership only when someone asks for it, what you have are alarms. Scheduled reporting (same format, same metrics, trend over trend, up through the CIO organization and into governance forums) turns risk into a standing conversation instead of an escalation. It also quietly builds the most useful exam asset there is: a long, boring, consistent record. When an examiner asks how leadership sees a given risk, the best possible answer is a stack of nearly identical reports going back two years.
Rehearse the changes that scare you
The riskiest thing a technology organization does is change. Examiners know it, which is why change management never leaves their list. Good looks like sequencing, rehearsal, defined rollback points, and the scary dependency promoted to a workstream of its own instead of a line in someone’s runbook. Rehearsed change also tends to be faster change, oddly enough, because rehearsal takes the discovery out of the critical path. And it leaves behind exactly the evidence an examiner hopes to find.
Notice that each of these habits is a cadence: weekly, dated, measured, scheduled, rehearsed. That is what an examiner is really probing for. Operating behavior is the only evidence a regulator can trust that a control exists at all; the binder only proves you can describe one.
If your risk program can’t survive a random Tuesday, it won’t survive an examination. Build for Tuesday.
Leave a Reply