MRA remediation proven before it is closed: agents test every closure request against its evidence, the validation lead decides and the Chief Risk Officer signs
Closures asked for only when the proof is there, and MRA dates kept on the record.
See one case, screen by screen ↓Audit Issue & MRA Tracking is MRA remediation and audit issue management in one place: risk and audit teams track internal audit findings, self-identified issues and examiner MRAs to validated closure. Each issue is a closure dossier, with the commitment on one side and the proof on the other. Agents test each closure request against its evidence and the system of record and write one cited verdict line; the validation lead decides, and the Chief Risk Officer signs every MRA closure and date change.
AI use cases in banking: a buyer's guide to agentic AI for bank and credit union operations →
Updated
MRA remediation runs on a register of promises: internal audit findings, issues the business found itself, and the examiners' Matters Requiring Attention, each with an owner, an action plan, milestones and a commitment date. Keeping the register is not the hard part. Closure is. An owner says done and attaches a policy and some minutes; internal audit's validators then re-perform by hand, pulling their own sample from the system of record to learn whether the fix was made and kept working, inside a validation clock of 15 business days at the sample bank.
The returns come late, and for the same reasons. On the sample register, 14 of 86 closure requests came back in September, 8 because sustained operation was not evidenced. Action plans built on training and reminder memos treat the symptom and fail validation months later. Dates slip without a timely, reasoned request, and the board and OCC reports are assembled by hand from register exports. An MRA closed on weak evidence is the costliest mistake of all: the examiner reopens it, and slow remediation is what turns findings into enforcement.
Estimated split for one closure request on a High-rated MRA, by hand and with the agents; our arithmetic, kept modest. The 'before' column totals the sample bank's 15-business-day validation clock.
Six agents read letters, test evidence in the systems of record and watch every date; the validation lead decides and the CRO signs.
Corvane National Bank, a fictional US regional bank supervised by the OCC, carries MRA 2025-07 on interest rate risk model assumption governance, committed for October 31, 2026. Daniel Okoro, its owner, asked for closure on October 14. Here is what happens on October 22, screen by screen, in the working solution.
The register opens on one line, then a short list. Each closure request shows the Evidence agent's read and its deadline: MRA 2025-07 not ready, 2 of 3 months, validate by Nov 4 with 6 business days left; MRA 2025-06 ready, 40 of 40 sampled accounts. Overnight the agents checked 6 closure requests, flagged 9 likely slips, read OCC letter CRE-2026-3 and drafted the board report.
“Renata, 9 issues ask you for closure and 14 you validate fall due in the next 30 days.”
MRA 2025-07 opens in two halves. On the left, the commitment: the OCC's Report of Examination of September 18, 2025, page 14, the root cause from action plan version 3 and four milestones. On the right, the proof for each milestone: 2 of 4 proven. Milestone 1, ALM Policy v7.2 naming ALCO as the approver, cites the board risk committee minutes of March 24, 2026, at confidence 0.98.
The examiner's words: “Management changed key interest rate risk model assumptions, including non-maturity deposit betas and decay rates, without ALCO review or approval.”
The milestone asks for three consecutive months of ALCO approval. The month strip reads July approved, August not, September and October approved, November 17 pending. One click on August opens the ALCO minutes of August 18, 2026, board portal item 5, with the passage highlighted. So the run is September and October, and the third month is the November 17 ALCO.
“The item was deferred to the September meeting; no resolution was adopted.”
The agent did not stop at the documents. It drew 25 of the 61 assumption changes logged from June 1 to October 15 in the ALM model change log, seed 7731, and all 25 cite an ALCO resolution (0.96). But the Q2 back-test, run July 9, has no validation sign-off, and review MV-2026-118 is not started (0.93). It proposes the earliest realistic date: November 30, 2026, after the November 17 ALCO and a validation review of the back-test.
“Not ready for validation: 2 of 3 months of operation evidenced.”
Renata opens the August minutes herself and agrees. She returns the request to Daniel Okoro with reason code RT-01, sustained operation not evidenced, and a new date of November 30, 2026; the note to the owner is drafted for her and she can edit it. She is the maker of the date change, so it waits for a checker.
“Returned to Daniel Okoro by Renata Cole on Oct 22 · RT-01 · Sustained operation not evidenced. New date Nov 30, 2026 waits for Victor Hale's signature.”
Sign-offs lists five items waiting for a second person, each with its maker and checker: the MRA 2025-07 date change, the closure of MRA 2025-10 on flood insurance compliance monitoring with 30 of 30 sampled loans, an audit date change and a rating change for the Internal Audit Director, and the Q3 board risk committee report. Renata sees no Sign button on her own request. Victor signs, and the signature records its meaning.
“You made this; Victor Hale signs.”
Once Victor signs, the OCC quarterly update carries the revised commitment date with the reason, and the board risk committee report for November 12 says why. The Reporting agent drafts both from the register, every sentence traced to an issue (34 of 34 in the Q3 draft), with confidential supervisory information marked. Nothing leaves until the Chief Risk Officer approves.
Drafted Oct 22, 08:00 · 34 of 34 sentences traced · no restricted detail.
Every action by people and agents is on the audit trail with who, what, when, why and the evidence. For the OCC examiners, the Export agent builds a pack for MRA 2025-07 alone: the dossier, 9 evidence files, decisions, sign-offs and the agents' runs with their prompt and model versions, under a SHA-256 manifest. Confidential supervisory information goes only to the OCC, and customer account numbers are redacted.
On IA-2026-114, wire call-back verification skipped for repeat beneficiaries, the root cause sits in the payments hub: it keeps a beneficiary verified permanently, and 7 of 30 sampled wires had changed details and no call-back. The agent labels two actions as treating the symptom and one as monitoring, and adds the milestone that fixes the cause: expire verification after 180 days or on any change of account details, proven by the configuration record and a sample of 25 wires.
Plan agent confidence 0.92 · next step: send to Rafael Ortiz, the owner, to confirm.
The same MRA, seen by four of the people who carry it, from the owner to the Chief Risk Officer: what closure looked like, and what it looks like now.
Six agents read letters, test evidence in the systems of record and watch every date; the validation lead decides and the CRO signs.
Reads OCC letters, reports of examination, internal audit reports and self-reported issues; splits each into findings, decides MRA, violation, non-binding observation or audit finding with the words that decide it, and proposes an owner, a root cause, a rating and a due date. It searches the open register and proposes a link instead of a duplicate.
Compares each action in a plan with the root cause and labels it: fixes the root cause, treats the symptom, or monitors. If no action changes the cause, it proposes one, with its evidence and a sample size from the validation rules.
Reads the evidence for each milestone and says in one sentence what it proves, with the passage. Where a control must operate over time, it samples records in the system of record and counts, then writes the verdict line with the gap and the earliest realistic date. It also runs the owner's pre-check.
Each morning at 06:00 reads every open issue's milestones, evidence pace and dependencies against its due date, flags likely slips with the reason, escalates at 30, 14 and 7 days, and drafts extension requests with a reason code and a realistic date.
Drafts the board risk committee report and the OCC quarterly MRA update from the register at the cut-off time, in the board template, citing the issue behind every sentence and marking confidential supervisory information.
Builds export packs for OCC examiners, the board risk committee, internal audit and the BSA Officer: dossiers, evidence, decisions, reason codes, sign-offs and agent runs, with a manifest of file hashes.
Validates or returns; the CRO signs. The agents propose; a named person decides.
Ask about any issue, milestone or piece of evidence, or say what to change. Every answer cites its source, and the assistant opens the screen it is talking about.
Why is MRA 2025-07 not ready to close?
Two things are missing. ALCO approved the assumption set in July and September, but in August it was deferred, not approved, so only 2 of the 3 consecutive months are evidenced. And the Q2 back-test has no validation sign-off; review MV-2026-118 is not started. With October approved, the third month is the November 17 ALCO: a new date of November 30 is realistic.
Was an unapproved assumption ever used?
No. The August model run used the July assumption set, which ALCO had approved. So no unapproved assumption reached reported results, but August is still not a month of approval, and the rule counts approvals.
Which MRAs could miss their date this quarter?
One MRA is likely to slip: MRA 2025-08, contingency funding plan testing, due Nov 20. The full liquidity stress test run moved to Nov 24. An extension draft is ready for Sofia Brennan; Victor Hale would sign it. MRA 2025-07 is asked for closure but not ready. The other 10 are on track.
How many closures failed validation last month?
In September, 14 of 86 closure requests were returned to the owner, 16%. The most common reason was sustained operation not evidenced (8), which is what the owner's pre-check now catches before an owner submits. High-rated issues need 3 months of operation.
13 screens from the working solution, on its sample data. Pick one to see it large.
The rules every closure is tested against are settings. A change is proposed by the Issue Management Office, approved by the Internal Audit Director and versioned (v12 today).
| Setting | Default | Choose from |
|---|---|---|
| Months of sustained operation before closure | High 3 · Moderate 2 · Low 1 | A number of consecutive months for each rating |
| Records the Evidence agent samples | 25 · 15 · 10, by rating | A sample size for each rating |
| Owner pre-check before asking for closure | On | On · Off |
| Validator independence | On: a validator who worked on the issue or reports to its owner is excluded | On · Off |
| Issues internal audit owns are validated by the second line | On | On · Off |
| Validation clock | 15 business days from the closure request | Any number of business days |
| Reminder ladder | 30 · 14 · 7 days | Owner, executive sponsor, then Chief Risk Officer or audit director |
| Date changes allowed per issue | 2 | A third change goes to the board risk committee |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample data · “target” = the design goal, measured in the live solution · “typical” = a published figure: about 1,800 outstanding supervisory findings at large firms (Federal Reserve, Supervision and Regulation Report, November 2018) and $536 million in penalties at one large bank since 2020 for slow remediation (public OCC and Federal Reserve actions) · “estimated” = our estimate. Regulations are named as context only: OCC and FDIC, Unsafe or Unsound Practices; Matters Requiring Attention (final rule, Federal Register, September 1, 2026), 12 CFR 4.36, 12 CFR 21.11(k) and 31 CFR 1010.430. Corvane National Bank and the people, issues, letters and records named on this page are fictional: characters and sample data in the working solution.
Audit Issue & MRA Tracking is MRA remediation and audit issue management in one place: risk and audit teams track internal audit findings, self-identified issues and examiner MRAs to validated closure. Each issue is a closure dossier, with the commitment on one side and the proof on the other. Agents test each closure request against its evidence and the system of record and write one cited verdict line; the validation lead decides, and the Chief Risk Officer signs every MRA closure and date change.
An MRA is an examiner's finding that the bank must fix by a commitment date the examiner will check. Under the OCC and FDIC rule published September 1, 2026, an MRA is for a violation of law or a practice that has caused, or could reasonably be expected to cause, material financial harm; examiners may also give non-binding observations, which the agencies do not track like MRAs. MRA remediation is fixing the cause, proving the fix kept working and reporting progress until the examiner decides to close it.
The validation rules set how many months of sustained operation each rating needs (High 3, Moderate 2, Low 1) and how many records to sample (25, 15, 10). The Evidence agent reads the evidence, samples the system of record with the seed recorded, and writes one cited sentence per milestone and a verdict line. The validation lead validates, returns with a reason code, or overrides the agent with a reason code of her own.
The Intake agent splits each letter into findings and marks each one as a Matter Requiring Attention, a non-binding observation or already open, citing the words that decide it. In the sample, OCC letter CRE-2026-3 becomes one MRA, one observation tracked by choice, and a link to an issue already on the register instead of a duplicate. The Issue Management Office registers, and the Chief Risk Officer confirms a new MRA.
The Overdue agent reads every open issue each morning and flags likely slips from the pace of evidence and dependencies, before the date. Reminders go to the owner at 30 days, the executive sponsor at 14 and the Chief Risk Officer or audit director at 7. It drafts the extension request with a reason code; a different person signs the new date, and the OCC quarterly update carries it with the reason.
People decide. The agents read, sample, draft and propose; they never validate, sign, send a report, register an issue or move a date. Owners cannot validate their own issues, makers never sign their own changes, and every decision carries a reason code and a named person on the audit trail.
Confidential supervisory information is marked on MRA dossiers, letters and reports and goes only to the OCC, in line with 12 CFR 4.36. Issues that reference a SAR are visible only to the BSA team; others see only the number, date and status, and only the BSA Officer can build a BSA pack. Customer data in evidence is redacted by default.
The Agentic Solution Engine builds and deploys it from your requirements and documents, such as your issue types and ratings, validation rules, reason codes and a recent exam letter, and it goes live once every quality gate has passed. We will walk you through it first on one of your own closure requests.
Every recovery time proven by test evidence, every breach fixed with an owner and a date.
1-min demoALCO ReportingAn approved ALCO pack in 3 days, with every change explained and cited.
1-min demoInterest Rate Risk (IRRBB) ManagementEvery key assumption checked against what members actually did, with proof for examiners.
1-min demoWe'll run Audit Issue & MRA Tracking on your issue register, a recent exam letter and the evidence behind one closure request.