Examiners do not close a finding because management says it is fixed. They validate remediation against a three-part standard: the corrective action is implemented (the change actually exists), effective (it addresses the root cause and produces correct outcomes), and sustained (it keeps working after the project team moves on). Validation happens through evidence review, transaction re-testing, interviews, and, for formal actions, independent third-party review, at follow-up contacts and subsequent examinations.
Understanding how that verification works changes how you remediate. Institutions that build validation-ready evidence as they execute close findings at first follow-up. Institutions that declare victory in a memo re-open them, and repeat findings are the most reliable escalation trigger in bank supervision.
Key Takeaways:
- The closure standard is implemented, effective, and sustained; a completed project plan satisfies only the first part
- Examiners verify through artifact review, independent re-testing of transactions and controls, and interviews with the people operating the fixed process
- Consent orders frequently require independent validation by internal audit or a third party before the agency will accept a provision as complete
- The most common validation failure is fixing the symptom cited in the finding while leaving the root cause in place
- Sustainability is demonstrated with operating evidence across time, not with the first month's output
The Standard: Implemented, Effective, Sustained
Supervisory policy at every federal agency commits examiners to follow up on findings until corrective action is verified. Federal Reserve SR 13-13/CA 13-10 directs findings to the board for corrective action and provides for supervisory follow-up on their resolution. OCC Bulletin 2014-52 frames MRAs around management's corrective action and commitment, which examiners then track to closure. The FDIC's Risk Management Manual of Examination Policies builds prior-finding review into the examination process itself: every exam begins with the status of what the last one found.
In practice, examiners decompose closure into three questions:
- Implemented. Does the committed change exist? The revised policy is approved, the system configuration is live, the staff are hired and trained, the new control is operating.
- Effective. Does the change fix the deficiency that was actually cited, at its root cause? A new procedure that nobody follows, or that addresses a narrower problem than the finding described, fails here.
- Sustained. Has it kept working across a meaningful period under normal operating conditions, including through volume changes and staff turnover?
Management can assert the first. Only evidence demonstrates the second and third.
When Validation Happens
Validation is not a single event. Expect verification at several points:
- Written progress reporting. For significant findings, agencies often request interim status reports. Examiners read these against your corrective action plan dates and note slippage.
- Follow-up or targeted examinations. Serious findings, MRIAs especially, draw a dedicated follow-up visit or targeted review within months rather than waiting for the next cycle. How long remediation takes covers typical windows by severity.
- The next full examination. Every open finding from prior supervisory materials is on the scope memo. First-day letters routinely request the finding log, CAP status, and closure evidence up front.
- Consent order reporting cadence. Formal actions impose their own rhythm: compliance committee meetings, quarterly progress reports to the regional office, and provision-by-provision review, running until the agency terminates the order.
What Examiners Test During Validation
Artifact review
Examiners start with the closure package: the finding, root cause analysis, corrective actions, and the dated evidence of each. They check internal consistency, that dates line up, approvals exist, versions match, and the evidence actually demonstrates what the status report claims. Our guide to examiner-ready evidence requirements covers what makes artifacts credible: dated, attributable, and generated by the process rather than reconstructed for the exam.
Independent re-testing
For findings rooted in transaction-level failures, examiners re-perform the test that produced the finding. If the finding was late Regulation E error resolutions, they pull a post-remediation sample and check the timelines themselves. If it was CDD gaps, they sample accounts opened after the fix date. Passing your own QA testing is helpful; the examiner's sample is the one that counts.
Interviews with operators
Examiners talk to the people running the remediated process, not just the project owner. They ask what changed, how exceptions are handled, and what happens when the volume spikes. A control that exists on paper but is unfamiliar to the person executing it fails the effectiveness test in a twenty-minute conversation.
Root cause check
Finally, examiners test whether the fix matches the cause. If the cited cause was under-resourcing and the fix was a procedure update, the finding stays open. This is where root cause discipline in the original response pays off or does not.
Validation Under Consent Orders
Formal enforcement actions raise the bar in three ways, visible across the public record in the agencies' enforcement databases, such as the FDIC's Enforcement Decisions and Orders:
- Independent validation is frequently required by the order itself. Provisions commonly require internal audit or a qualified independent third party to validate corrective actions, with results reported to the board and available to examiners. Management's own attestation is explicitly insufficient.
- Lookbacks test the past, not just the future. BSA/AML orders in particular often require retrospective transaction reviews covering a defined period, with SAR filings for what the lookback surfaces. The remediation is not complete until the historical exposure is resolved.
- Non-objection gates decisions. Orders can require regulator non-objection before specific activities resume or expand, which means the agency re-reviews your evidence at each gate. Partner banks under BaaS-related orders, for example, have faced non-objection requirements for onboarding new fintech programs; see sponsor bank consent orders.
Termination follows the same logic as closure, compounded: every provision implemented, effective, and sustained, verified through examination, before the agency ends the order. The bank asserts; the agency decides.
Why Findings Fail Validation
The recurring failure patterns are worth naming, because each one is avoidable at remediation design time:
- Symptom fixed, cause intact. The specific instances cited in the finding were corrected, but the condition that produced them was not.
- Point-in-time evidence. The closure package shows the control working in the month before follow-up and nothing since implementation. Sustained means a continuous record.
- Evidence that cannot be attributed. Undated screenshots, unversioned policies, and completion claims with no named performer do not survive artifact review.
- Validation by the implementer. The person who built the fix also signed off that it works. Examiners expect second-line or audit involvement proportional to the finding's severity.
- Process decay. The fix worked until the trained person left or volumes doubled. This is the pattern behind most repeat exam findings.
Building Remediation That Passes Validation the First Time
The institutions that close findings at first follow-up run remediation as an evidence-producing process from day one: every corrective action has an owner and a date, every completion generates a dated artifact, effectiveness is tested by someone other than the implementer, and the operating evidence keeps accumulating after go-live so sustainability is demonstrable, not asserted.
Canarie operationalizes exactly that loop. Findings become corrective action plans with named owners and deadlines, completed work captures its evidence automatically, and validation steps are tracked as explicitly as the fixes themselves, so the closure package examiners will test already exists when they arrive.
See how findings move from response to verified closure →
Frequently Asked Questions
What does it mean for a finding to be validated?
Validation means the regulator, or an independent party the regulator relies on, has verified that the corrective action is implemented, effective at addressing the root cause, and sustained over time. It is distinct from completion: management completes corrective actions, but only verification against evidence closes the finding.
Who validates consent order remediation?
Layered verification is typical: management executes, internal audit or a qualified independent third party validates effectiveness where the order requires it, the board reviews and credits progress, and the issuing agency makes the final determination through examinations and required progress reports. The order's own language controls what independent validation is required.
How long must a fix operate before examiners consider it sustained?
There is no universal number; examiners judge sustainability against the finding's severity and the process's cycle. As a working rule, expect to show several months of normal-course operating evidence, covering at least one full cycle of the control (a quarter for a quarterly control), before closure, and longer for formal enforcement provisions.
Can a bank close a finding itself once remediation is complete?
A bank can and should track its own status, including marking actions complete and internally validated. But supervisory closure belongs to the agency. Report completion with evidence, request closure, and expect examiners to verify before the finding comes off the supervisory record.
What happens if remediation fails validation?
The finding stays open and the stakes rise. A failed validation is functionally a repeat finding: expect intensified follow-up, skepticism toward the next status report, and, if the pattern continues, escalation from MRA to MRIA or from supervisory finding to enforcement action.
Remediation is not done when the project plan says done. It is done when an examiner, testing your evidence against the original deficiency, agrees the problem cannot recur unnoticed. Build toward that test from the first day of the corrective action plan and validation becomes confirmation rather than risk.