Closing an MRA (Matter Requiring Attention) takes more than fixing the cited problem. Between "we received the finding" and "the examiner closed it" sit seven stages: acknowledgment and ownership, root-cause analysis, a corrective action plan, tracked execution, independent validation, a sustainability period, and examiner verification. Institutions that treat closure as a documentation exercise at the end, rather than a process that generates evidence throughout, are the ones whose findings reopen.
Key Takeaways:
- MRA closure runs through seven distinct stages, from board-level ownership through examiner validation
- Examiners reject symptom fixes; the root-cause analysis determines whether the correction will hold
- Internal validation must be independent — the person who built the fix cannot be the one who tests it
- Closure requires a sustainability period showing the corrected process operates over time, not just once
- The closure evidence package assembles the original finding, the plan, execution artifacts, validation results, and sustained-performance evidence
The Seven Stages of MRA Closure
Only the examiner can close a supervisory finding. Everything before that point is the institution building the case for closure. Here is the sequence that case follows.
Step 1: Acknowledge the Finding and Assign Ownership
Assign an executive owner with authority over the underlying process, not a committee and not a junior analyst. The board should see the finding, discuss it, and approve the ownership assignment, with all of it reflected in the minutes. Federal Reserve SR 13-13/CA 13-10 directs supervisory findings to the board precisely because regulators hold the board accountable for resolution.
Step 2: Run a Root-Cause Analysis
Examiners consistently reject symptom fixes. If the finding cited stale risk assessments, the root cause is rarely "the document was old"; it is that no process, owner, or trigger existed to refresh it. Ask why the deficiency occurred and keep asking until you reach a cause you can change: staffing, systems, policy design, training, or oversight.
Step 3: Build the Corrective Action Plan
The corrective action plan (CAP) translates the root cause into commitments: specific milestones, named owners, and completion dates. Vague plans ("management will enhance monitoring") invite follow-up criticism; dated, assignable actions do not. Our guide on how to write a corrective action plan provides a structure examiners recognize.
Step 4: Execute with Progress Tracking and Interim Reporting
Execution is where most findings quietly stall. Track each milestone against its committed date, escalate slippage before it compounds, and report progress to the board on a regular cadence so the minutes show active oversight. A practical system for tracking exam findings through remediation matters more here than anywhere else.
Step 5: Validate Internally — Independently
Before claiming the fix works, someone independent of the remediation must test it: internal audit, a second-line testing function, or a qualified external party. Validation should run the corrected process against fresh samples and document scope, method, exceptions, and conclusions. Self-certification by the team that built the fix carries little weight with examiners.
Step 6: Demonstrate Sustainability
A control that worked once is not a corrected control. Examiners look for evidence that the corrected process has operated through multiple cycles: several months of monitoring reports, consecutive quarterly reviews completed on time, or repeated committee meetings with the new agenda item. Plan for this period when setting CAP dates; closure evidence cannot exist before the process has had time to run.
Step 7: Examiner Validation
The finding closes when the examiner says it closes, either at a targeted follow-up review or at the next examination. The institution's job is to make that decision easy: a complete, organized evidence package that lets the examiner trace the path from finding to sustained correction without requesting anything twice.
What Goes in the Closure Evidence Package
When examiners assess whether to close a finding, they expect to see the full arc, not just the endpoint:
- The original finding, as written in the report of examination or supervisory letter
- The board-approved corrective action plan, with milestones, owners, and dates
- Execution artifacts: revised policies, system configuration changes, new procedures, training records, hiring documentation
- Validation testing results: who tested, what was sampled, what was found, how exceptions were resolved
- Sustained-performance evidence: multiple periods of the corrected process operating, with dates and outputs
- Board minutes showing oversight from acknowledgment through completion
Gaps in this package are the most common reason a finding that "should" close stays open another cycle.
Why Closed Findings Reopen
Findings reopen, or reappear as repeat findings, for three recurring reasons. First, the fix addressed the cited instance but not the root cause, so the deficiency resurfaced in a new form; this is the core pattern behind why banks get repeat exam findings. Second, the institution corrected the process but kept no sustainability evidence, leaving examiners nothing to validate. Third, the fix held but broke an adjacent process — a new monitoring report that nobody was assigned to review, for example.
Each of these is preventable at an earlier stage: the first at root-cause analysis, the second at execution, the third at validation.
How Agencies Handle Follow-Up and Closure
The mechanics vary by regulator, but the burden of proof always sits with the institution. Under the Federal Reserve's SR 13-13 framework, MRAs and MRIAs remain open until the supervisory team confirms correction, and MRIAs carry compressed timelines with more frequent status reporting. An MRA left inadequately addressed can return as an MRIA, which resets the process at higher stakes.
The OCC documents each MRA under Bulletin 2014-52 using the Five Cs — Concern, Cause, Consequence, Corrective action, and Commitment — and examiners assess the board's commitment and the corrective actions during subsequent supervisory activities. FDIC-supervised banks work through Matters Requiring Board Attention with follow-up at the next examination or through interim contact, and NCUA credit unions resolve Documents of Resolution on the same logic. In every version, closure follows evidence, not assurances.
How Modern Teams Run Findings to Closure
The seven stages above are a project management and evidence problem running under supervisory scrutiny. Most institutions run it across a spreadsheet, an inbox, and a shared drive, which is why status reporting consumes as much effort as the remediation itself.
Canarie gives each finding a single workflow: corrective actions become assigned tasks with deadlines, every completed milestone captures its artifact at completion, validation and sustainability evidence accumulate against the finding automatically, and board reporting reflects live status instead of manually assembled updates. The closure package builds itself as the work happens.
See how compliance teams take findings from received to closed →
Frequently Asked Questions
How long does it take to close an MRA?
It depends on the complexity of the fix and the examination cycle, but plan in quarters, not weeks. The corrective action itself may take 60 to 180 days, the sustainability period adds several months of operating evidence, and examiner validation typically waits for a follow-up review or the next exam. Simple policy-level findings close faster; findings requiring system changes or staffing take longer.
Who validates that an MRA is closed?
Two layers of validation matter. Internally, a party independent of the remediation — internal audit, a second-line testing function, or an external reviewer — must test that the fix works. Externally, only the regulator closes the finding, after its examiners review the evidence at a follow-up review or subsequent examination.
What evidence do examiners need to close a finding?
Examiners want to trace the full arc: the original finding, the board-approved corrective action plan, artifacts proving each action was executed, independent validation results, and evidence that the corrected process has operated over multiple periods. Board minutes demonstrating oversight throughout are expected as well. Missing sustainability evidence is the most common gap.
Why do examiners reject corrective actions?
The most frequent reason is that the action fixed the cited symptom without addressing the root cause, which tells the examiner the deficiency will recur. Other common reasons include missed CAP milestones without explanation, validation performed by the same team that built the fix, and evidence that exists as assertion rather than artifact.
Can a bank close an MRA before the next exam?
The bank can complete remediation before the next exam, and should, but formal closure is the examiner's call. Some regulators conduct interim follow-up reviews, particularly for serious findings, and will confirm closure between examinations. More commonly, examiners validate corrective actions at the next scheduled examination, which is why sustained-performance evidence covering the intervening period matters.