Credit unions don't receive Matters Requiring Attention. They receive Documents of Resolution, and the distinction matters more than terminology, because a DOR is written as an agreement about what management will do by when. A repeat DOR is therefore read as a broken commitment, not just an unresolved issue.
Most repeat findings at credit unions trace to the same three causes: the corrective action addressed a symptom, the completion evidence was never assembled, or the fix worked but nobody could prove it eighteen months later when a different examiner asked.
Key Takeaways:
- A DOR is a documented commitment with agreed timeframes, which is why NCUA treats non-completion as a management issue rather than a technical one
- NCUA separates less significant examiner findings from DORs; conflating the two in your tracking causes the wrong items to get escalated attention
- Unresolved DORs escalate through informal enforcement - a Letter of Understanding and Agreement or Preliminary Warning Letter - before formal action
- The supervisory committee audit requirement under 12 CFR Part 715 is an oversight mechanism examiners expect you to use for finding validation
What a Document of Resolution Is, and How It Differs from an MRA
A DOR addresses a material problem or unsafe practice identified during examination and specifies the corrective action, the responsible party, and the completion date. It appears in the examination report and is tracked by NCUA into subsequent contacts until resolved.
Two structural differences from the bank framework are worth understanding if your tracking system or your compliance staff came from the bank side:
DORs are framed as agreements. MRAs communicate a supervisory concern that management must address. A DOR records what management has agreed to do, with dates management proposed or accepted. When the date passes without completion, the finding isn't merely open - a commitment was missed, and that becomes a management assessment item under the "M" in CAMELS.
NCUA distinguishes DORs from examiner findings. Less significant issues are documented as examiner findings rather than DORs. They still warrant correction, but they carry different escalation weight. Tracking systems that flatten everything into one generic issue type produce two failure modes: examiner findings consume attention meant for DORs, or DORs get triaged like minor items.
Note also that NCUA moved to CAMELS in 2022, adding the "S" component for sensitivity to market risk to the prior CAMEL framework. Findings that touch interest rate risk and balance sheet management now have a dedicated component rating they can affect.
How Unresolved DORs Escalate
The escalation path runs through informal enforcement before anything formal:
- Repeat DOR in the next examination - the finding recurs, with a management-oversight concern attached
- Letter of Understanding and Agreement (LUA) - an informal enforcement document signed by the board committing to specific corrective action
- Preliminary Warning Letter - used for serious or persistent problems, signaling that formal action is under consideration
- Formal administrative action - cease and desist orders, civil money penalties, prohibition orders, and in severe cases conservatorship
Institutions frequently underestimate how much the second step changes daily operations. An LUA commits the board to a schedule with reporting obligations, and it typically constrains growth, new products, or compensation decisions until the underlying issues resolve.
For federally insured state-chartered credit unions, examinations are coordinated with the state supervisory authority, and both regulators track resolution. A DOR closed with your state examiner but poorly documented for NCUA - or the reverse - produces avoidable friction, since the two agencies apply the same requirements under 12 CFR Part 741 but maintain separate examination records.
Why Repeat Findings Hit Credit Unions Specifically
Compliance staff is fractional, not dedicated. At institutions under roughly $500 million in assets, the person responsible for BSA, consumer compliance, and remediation tracking is often also running operations or lending. Remediation is the work that yields when something urgent arrives, and it yields quietly.
Volunteer boards have limited bandwidth. Directors meeting monthly, without full-time exposure to the institution, depend entirely on what management reports. If the finding report is a verbal update rather than a written status with overdue items flagged, oversight is difficult to evidence in minutes - and minutes are what examiners read.
The supervisory committee is an underused asset. Part 715 requires an annual supervisory committee audit, and the committee has standing authority to verify member accounts and review internal controls. Many credit unions treat this as an external audit procurement exercise instead of using the committee to independently validate that DOR corrective actions actually took effect. Examiners notice when validation is entirely self-reported by the same people who performed the remediation.
Extended examination cycles create drift. Well-rated smaller credit unions can go substantially longer between examinations. That is a benefit operationally and a hazard for evidence: the staff who implemented a fix may have turned over, and institutional memory of what was done and why erodes. NCUA's MERIT examination platform means examiners arrive with prior findings and their history already loaded, so the asymmetry runs against an institution relying on recollection.
The DOR Closure Package
Assemble these per DOR, and assemble them as the work happens rather than before the next examination:
| Element | What it has to show |
|---|---|
| Original DOR text | Verbatim from the examination report, with the agreed date |
| Root cause analysis | Why it happened, documented and reviewed by someone other than the owner |
| Corrective action detail | Specific steps, named owners, milestone dates |
| Implementation evidence | Dated artifacts - approved policy with version, training completion records, system change documentation |
| Validation results | Post-implementation sample testing showing the fix works, with methodology and sample size |
| Board and committee reporting | Minutes references showing status was reported and questions were asked |
| Monitoring plan | What metric detects recurrence, who reviews it, at what frequency |
The validation row is where most closure packages are thin. "Policy updated and staff trained" documents implementation. It does not establish that the underlying failure stopped occurring. Pull activity that happened after the corrective action took effect, apply the test that surfaced the original problem, and retain the result. If the sample fails, the DOR isn't closed regardless of what was implemented.
The lifecycle mechanics apply across charter types and are covered in more depth in tracking and remediating compliance exam findings.
Board Reporting That Evidences Oversight
Examiners review board and supervisory committee minutes specifically for evidence that findings received attention. Reporting should be written, recurring, and include open DORs by age, items past their agreed date with explanation, closures since the last report, and validation status.
The detail that distinguishes strong minutes: recorded questions. A minute entry showing directors asked why an item is 60 days past its committed date, and management's response, demonstrates active oversight. A minute entry stating "compliance report received" does not. Getting this right is largely a function of how the board compliance report is structured.
Cross-reference your own reporting against the regulations most likely to generate findings - Part 748 for security program and BSA obligations, Part 749 for records preservation, and the consumer regulations flagged in NCUA's annual supervisory priorities letter. Findings cluster where requirements are recurring and evidence is easy to skip.
How Credit Unions Track DORs to Validated Closure
The institutions that stop repeating findings run DOR remediation as scheduled work with the same accountability as everything else: each corrective action has an owner and a date, evidence attaches at completion, overdue items escalate on their own rather than waiting for someone to notice, and validation is a required step before closure. Board reporting reads from that live record instead of being rebuilt from memory each quarter.
Canarie handles DORs and examiner findings as distinct workflow types through exam preparation automation, with evidence captured as work is completed. What that looks like alongside the rest of an NCUA-facing program is covered in credit union compliance software for NCUA exams.
See how DORs move from agreed action to validated closure →
Frequently Asked Questions
What is the difference between a DOR and an MRA?
Both identify problems requiring corrective action, but they come from different supervisory frameworks. NCUA issues Documents of Resolution to credit unions, written as agreements specifying what management will do and by when. Bank regulators issue Matters Requiring Attention, which communicate a supervisory concern management must address. Because a DOR records an agreed commitment with dates, missing the date is treated as a management issue in addition to an unresolved finding.
How long does a credit union have to resolve a DOR?
The timeframe is specified in the DOR itself, agreed during the examination, and varies with severity and complexity. There's no universal deadline. What matters more than the length is meeting the date you accepted: missing a commitment you proposed is viewed less favorably than proposing a longer, realistic timeline at the outset and meeting it.
Do repeat findings affect our CAMELS rating?
They can, most directly through the management component, because recurrence suggests corrective action or oversight was ineffective. Depending on subject matter, repeats can also affect the component the finding relates to - asset quality, earnings, liquidity, or sensitivity to market risk. Repeat findings are also a factor in whether NCUA pursues informal enforcement such as a Letter of Understanding and Agreement.
Can the supervisory committee validate DOR remediation?
Yes, and using it that way strengthens your position. The supervisory committee's independence and its authority under 12 CFR Part 715 make it well suited to verify that corrective actions took effect, rather than having validation performed solely by the staff who implemented the fix. Document what the committee tested and what it found.
What happens if we disagree with a DOR?
Raise it during the examination, before the report is finalized, since a DOR reflects agreed corrective action and the exit meeting is where the terms are negotiated. If disagreement persists after issuance, NCUA maintains a supervisory review process for material supervisory determinations. Respond in writing with factual support, and address the finding on the agreed schedule while the disagreement is pending.