A branch scorecard for control is a short set of measures, reported by branch and region every quarter, that shows whether branch controls are working: repeat findings, exceptions closed on time and with checked evidence, overdue exceptions, surprise counts that were truly unannounced, security devices tested, and how often internal audit reaches the same result when it re-performs a step. A scorecard that reports completion instead, the share of branch reviews done and signed, is easy to count and says almost nothing, because a branch that ticks every box on time scores perfectly whether or not its vault is opened by one person. Botminds' Branch Self-Assessment produces the control measures as a by-product of the review itself: every exception, closure, count and device check carries its evidence, so the scorecard is counted rather than compiled.
Examples on this page come from a fictional sample credit union in the solution, Norrell Federal Credit Union, with 38 branches in four regions, each reviewed every quarter. Its people and numbers are sample data, and the time figures are our estimates.
A branch scorecard for control: eight measures, what each means and where it comes from
Repeat findings
DefinitionExceptions on the same checklist item at the same branch within four quarters, counted when the second one opens.
Counted fromFollow-up flags across quarters
Why it is on the scorecardSays a correction did not hold. Examiners ask whether past audit deficiencies were corrected.
Exceptions closed on time
DefinitionShare closed by the due date set for their severity, by branch and region.
Counted fromException history
Why it is on the scorecardShows whether owners act, not whether problems exist.
Closed with checked evidence
DefinitionShare of closures where a second person verified the evidence the owner submitted.
Counted fromClosure decisions and their evidence
Why it is on the scorecardSeparates a fixed problem from a promised one. Target: every closure.
Overdue exceptions
DefinitionCount and age of open exceptions past their due date, with whom each is escalated to.
Counted fromException queue
Why it is on the scorecardThe earliest sign a branch has stopped working its list.
Surprise counts truly unannounced
DefinitionShare of surprise counts where the date or drawer was chosen outside the branch and not known before the count started.
Counted fromCount log: who chose, when, who counted
Why it is on the scorecardA count the branch expected tests preparation, not control.
Security device tests recorded
DefinitionAlarm, hold-up alarm and camera checks recorded against those due, per branch.
Counted fromSecurity system extracts
Why it is on the scorecardThe rules require the program to provide for testing devices.
Re-performance agreement
DefinitionShare of steps internal audit re-performed from stored evidence that reached the same result.
Counted fromInternal audit conclusions
Why it is on the scorecardThe one measure of whether the self-assessment can be relied on.
Manager overrides of agent verdicts
DefinitionDisagreements with a reason code, in both directions, by branch and step.
Counted fromWalk decisions
Why it is on the scorecardHigh in one direction is a reading problem; high at one branch is a question.
What should be on a branch scorecard?
A branch scorecard should carry two halves kept apart: performance (deposits, accounts opened, service times, sales) and control (whether the branch's controls work). The phrase is used for both; this page is about the control half, the measures a head of branch operations, a security officer and an audit committee need, and it argues for one rule above the rest: measure outcomes of the review, not the review's completion.
The eight measures above meet that rule. Each is counted from something the review leaves behind (an exception, a closure, a count log, a system extract, an internal audit conclusion), each can be broken down by branch and region, and each would change if a branch's controls got better or worse. A completion rate fails the last test. In the sample credit union every branch completes a review every quarter; the interesting differences are in what the reviews found and what happened next.
Why a completion rate misleads
A completion rate rewards the act of reviewing, so it climbs fastest where reviews are thinnest. A branch manager who walks the checklist quickly, ticks every line and submits on day one scores the same as one who photographs every log and opens three exceptions, and the second branch looks worse on any scorecard that counts exceptions without context. That is the opposite of what an examiner or an internal auditor would conclude.
The fix is to report completion only as a hygiene line and to put the weight on what reviews produce. A program where every review is complete and repeat findings are falling is working. A program where every review is complete and repeat findings are flat has a correction problem, whatever the completion rate says.
What is a repeat finding, and why does it lead the scorecard?
A repeat finding is an exception on the same control at the same branch that was found and supposedly corrected before. It leads the scorecard because it is the clearest evidence that a correction did not work, and because examiners look for it. The Federal Reserve's cash examination procedures tell examiners to "obtain a listing of any deficiencies noted in the latest review done by internal or external auditors" and to "determine if appropriate corrections have been made", and to review "uncorrected audit deficiencies" with management (CBEM 2310.3).
Counting repeats needs a definition the whole institution uses. The one on our scorecard is the same checklist item, at the same branch, within four quarters. In the sample credit union's review of its Cedar Hollow branch, the vault was opened by one employee on 9 October, and the Follow-up agent marked the exception as a repeat because the same branch had done the same on 28 May; the exception opened as high and the security officer was told the same day. Repeat findings can also be counted across branches, by checklist item, to show controls that fail everywhere, which is usually a procedure or training problem rather than a branch problem. The solution's design target for the program is to halve repeat findings within a year.
Exceptions at every branch in Branch Self-Assessment, filtered to repeats
Exceptions closed on time, and closed with checked evidence
Two closure measures belong on the scorecard, and the second matters more. "Closed on time" counts exceptions closed by the due date set for their severity; in the sample configuration that is ten days for high, 14 for medium and 30 for low, with reminders three days before and escalation to the regional manager one day after. It shows whether owners act.
"Closed with checked evidence" counts closures where someone other than the owner looked at the evidence before closing. A finding closed on the owner's say-so can be closed on time and still be open in practice, which is how repeat findings are made. The solution is built so that every exception has a named owner and a due date and is closed only after a second person has checked the evidence, which is a design target the scorecard can test quarter by quarter. In the sample vault exception, the owner proposed closure with a coaching note and dual-control attestations from all 11 staff; the Follow-up agent checked the 11 signatures against the staff list; the regional manager or the security officer verifies and closes.
Device and procedure measures from the security program
The security program contributes the measures most likely to be wrong in the dark: devices that are installed but not working. The bank security rules require the program to provide for selecting, testing, operating and maintaining security devices, so "tests recorded against tests due" is a direct measure of the program the board is told about. In the sample year the credit union's monthly alarm tests were recorded at every branch, 342 of 342 by the end of September, each from the security system rather than a manager's note.
Testing matters because devices fail in use. The FBI's statistics for 2023 count fewer incidents in which an alarm functioned than in which it was activated, and the same for cameras; the figures and what they mean for a testing schedule are in FBI bank robbery statistics: alarms that went off and did not work. A scorecard line for camera recording, footage retained for the set period, and recorder clocks within a tolerance catches the quiet failures before an incident does.
Where the checks on the sample branch checklist come from
Checklist Q4 2026 v7: 64 checks
- Done by agents from the systems before the walk · 66%
- Walked by the branch manager, one photo each · 34%
Branch manager’s hours on one quarterly review, paper
- Pulling and comparing file samples · 25%
- Counting vault, drawer, consigned items · 17%
- Walking logs, alarm panel, cameras, notices · 25%
- Writing up evidence and exceptions · 21%
- Chasing owners and questions · 12%
How do you compare branches fairly?
Compare branches on rates and repeats, never on raw exception counts. A branch that opens more exceptions may simply be looking harder, and a league table of exceptions teaches managers to find fewer. Three adjustments make comparisons fair. Normalize by what was tested: exceptions per hundred checks performed, not per review. Weight by severity, so a vault dual-control failure is not netted against a missing lobby poster. And read repeats and closure quality ahead of counts, because those depend on what the branch did after finding a problem, which is the part a manager controls.
Re-performance agreement is the tiebreaker. When internal audit re-performs a sample of steps from the stored evidence and reaches the same result, the branch's self-assessment can be relied on, and its low exception count means something. When it does not, the branch's scores are suspect whatever they show. In the solution, internal audit's conclusion on each re-performed step is recorded next to the original, so the agreement rate is a count, not an impression.
What are leading indicators of branch control problems?
Leading indicators are the measures that move before a loss does: overdue exceptions, manager overrides concentrated at one branch, controls tied to staff changes, and cash held over limit. Each is visible in the data a branch review already touches.
Leading indicators a branch scorecard can watch every quarter
- Exceptions overdue, and escalations that do not move them
In the sample queue, a combination not changed after a departure was 13 days overdue and escalated.
- Combinations and alarm codes not changed after a departure
The Federal Reserve’s questionnaire expects vault combinations to change whenever custody changes. The sample security system check compares alarm codes with current staff: 11 codes, 11 staff.
- Cash over limit at close
A drawer or vault routinely over its limit is exposure the security officer’s device decisions did not assume.
- After-hours entries outside the schedule
Badge and alarm events the security system already records.
- Overrides of the reading agent at one branch
Disagreements are healthy; disagreements that always clear exceptions are a pattern.
- Staff who have not been away from their duties
The FDIC expects a policy of at least two consecutive weeks’ absence for officers and employees; a branch where nobody has covered a drawer has not tested its own controls.
- Repeat findings by checklist item across branches
A control failing everywhere points at the procedure or the training, not the branches.
What does a branch review cost?
The largest cost of a branch review is the branch manager's time, and most of it goes into finding and comparing rather than judging. Our estimate for the sample credit union is about six hours of a branch manager's time for one quarterly review on paper, plus about two more hours of regional and internal audit follow-up, against about two hours with agents doing the system checks before the walk. The estimate is ours, built from the solution's design figures for the sample credit union, not a measured customer result.
Where a branch manager's hours go on one quarterly review: paper against agents (estimate)
At program scale the arithmetic is simple. Thirty-eight branches reviewed four times a year is 152 reviews; at six hours each that is about 912 branch-manager hours a year, and at two hours about 304, before counting the regional and audit follow-up the paper reviews also need. The saving is real, but it is the smaller argument. The larger one is that the hours that remain are spent on the 22 checks that need eyes, and every one of them leaves evidence the scorecard can count.
How do you report branch reviews to the board?
Report them through the security program report and the audit committee, with the scorecard as the spine. At a bank, the security officer reports to the board at least annually on the security program, and the OCC rule requires the substance of that report to appear in the minutes of the meeting where it is given (12 CFR 21.4). At a credit union the president certifies the security program every year, and the Supervisory Committee oversees audit. A board does not need the 64 checks; it needs to know whether repeat findings are falling, whether exceptions close with evidence, whether devices were tested, and where internal audit disagreed.
The sample credit union's quarter view shows what a regional manager sees before any of that reaches the board: each branch's review state and date, the open exceptions per branch, and a preparation that failed because the teller platform did not answer, waiting to be retried. A scorecard drawn from that view inherits its honesty: a branch whose review could not be prepared shows as such, rather than as a pass. For the security officer's side of the board report, see the bank security officer; the solution is at Branch Self-Assessment.
The quarter at 38 branches in Branch Self-Assessment: the view a scorecard is counted from
Questions people ask
What KPIs measure branch compliance?
The most useful are repeat findings, the share of exceptions closed on time, the share closed with evidence checked by a second person, overdue exceptions, security device tests recorded against tests due, and internal audit's agreement rate when it re-performs steps. Completion of reviews is a hygiene measure, not a compliance KPI.
How do you measure a branch self assessment program?
By its outcomes and its reliability. Outcomes are whether repeat findings fall and exceptions close with checked evidence. Reliability is whether internal audit, re-performing a sample of steps from the stored evidence, reaches the same result as the branch did.
What is a good repeat finding rate?
No regulator sets one. The useful comparison is with the program's own history: repeats should fall after the first year of evidence-based closures. Branch Self-Assessment's design target for the sample program is to halve repeat findings within a year.
Should a branch scorecard rank branches?
Rank on rates, repeats and closure quality, not on exception counts. A branch that finds more exceptions may be the most honest one; ranking on counts teaches managers to look less closely.
Who should own the branch scorecard?
A natural owner is the head of branch operations, with the security officer owning the device and procedure lines and internal audit owning re-performance agreement. The audit committee or Supervisory Committee should see it at least as often as it meets.