A branch self assessment is the scheduled review a branch manager runs of their own branch, on a cycle the institution sets, such as every quarter: cash and dual control, consigned items, samples of new-account, currency transaction and hold-notice files, record retention, notices and the branch's part of the security program, with evidence for each, then reviewed and signed by someone senior who did not perform it. It is hard to do well for a simple reason: the person reviewing the controls is the person who runs them, so a review that leaves only ticks proves little to the internal auditors and examiners who must later rely on it. Botminds' Branch Self-Assessment exists to make the self-assessment provable. Agents do the checks that live in systems before the branch opens and read every photograph on the walk; exceptions get owners and due dates; a regional manager signs; and internal audit can re-perform any step from the stored evidence.
Take one branch of a fictional sample credit union as its fourth-quarter review runs through the solution. Norrell Federal Credit Union reviews all 38 of its branches every quarter; Cedar Hollow, branch 17 in its North region, has 11 staff and a branch manager named Leah Okafor. Every person, branch, member and figure that follows is sample data.
One branch self assessment, from preparation to the board meeting, in days
- Prepared, walked, signed4 d
- Exceptions open to their due dates13 d
- Roll-up drafted for the board, meeting 18 Nov13 d
- Prep3 d
- Open from 22 Oct, owner the branch manager11 d
- Prep3 d
- Open from 22 Oct, owner the member service representative14 d
What is a branch self assessment?
A branch self assessment is management testing its own branch controls, with a senior reviewer's signature, between the visits of internal audit. Regulators are explicit about both its value and its limit. The Federal Reserve's examination manual, discussing the internal audit function, says that self-assessments help but cannot stand alone.
Some institutions have chosen to rely on so-called management self-assessments or control self-assessments, wherein business-line managers and their staff evaluate the performance of internal controls within their purview. Such reviews help to underscore management’s responsibility for internal control, but they are not impartial.
Federal Reserve, Commercial Bank Examination Manual, section 4500.1
The same passage goes on: "Therefore, institutions generally should also have their internal controls tested and evaluated by units without business-line responsibilities, such as internal audit groups." That sentence explains everything that follows in this case. A branch self assessment earns trust in two ways: by leaving evidence someone independent can re-perform, and by putting a second person on every signature and every closure. Branches still matter enough to justify the effort: in the FDIC's 2023 household survey, 67.9% of banked households used a bank teller at least once that year (FDIC, 2023 National Survey of Unbanked and Underbanked Households).
The four people one branch self assessment passes through
Today
Most of a day on the quarterly checklist between member appointments, pulling files and ticking boxes nobody can check.
With agents
Walks the 22 checks that need eyes, one per screen on a phone, takes the photo, and agrees or disagrees with each verdict.
Still theirs: the walk, the decisions and the branch’s exceptions
Today
Signs on the strength of a tick, then learns a quarter later that an exception never closed.
With agents
Signs after reading the cited summary and the photos; closes exceptions only after checking the evidence.
Still theirs: the signature, which the performer cannot give
Today
Hears about a vault opened by one person when the paper arrives; builds the board report once a year.
With agents
Is told the same day, owns each branch’s security items, reviews a board report already drafted.
Still theirs: every possible internal incident
Today
Drives to branches to re-check what the checklist says was reviewed.
With agents
Re-performs any step from the stored evidence and records agreement or disagreement next to the original.
Still theirs: an independent conclusion
Monday, 6:00 a.m.: the records a branch self review samples, checked before the branch opens
The review starts three days before the branch manager touches it. At 6:00 a.m. on Monday 19 October, with the branch closed, the Review planner built the review from the approved checklist, version Q4 2026 v7: 64 checks, 22 to walk and 42 from the systems. The Sampling agent pulled 18 files from document imaging and the BSA reporting system: five of 61 new memberships opened in the third quarter, three of nine currency transaction reports, four of 27 Regulation CC exception hold notices and six retention records. The Cash agent reconciled the vault, four drawers, 212 official checks, 147 money orders and 38 gift cards to the teller platform and the general ledger. The Security agent ran 11 checks against the security system. By 6:32 the agents were done.
Seventeen of the 18 samples passed. The exception was a new membership opened on 14 September with no ID expiration date in the core, while the imaged driver's license showed 03/14/2029. The customer identification rule requires the record to describe the document relied on, including its expiration date where it has one (31 CFR 1020.220). The agent prepared the correction but could not make it: the member service representative who opened the membership enters it in the core, and the branch manager verifies it against the image.
What the agents checked at Cedar Hollow before the walk
| Area | What was checked | Result |
|---|---|---|
| File samples | 5 of 61 new memberships (CIP), 3 of 9 CTRs, 4 of 27 Reg CC exception hold notices, 6 retention records, against the core and the BSA reporting system | 17 of 18 passed; 1 ID expiration date missing |
| Cash and consigned items | Vault, 4 drawers, 212 official checks, 147 money orders, 38 gift cards against the teller platform and general ledger | All equal; exact match only |
| Security system | Alarm tests to 6 Oct, 16 cameras, 94 days of footage, alarm codes against staff, after-hours entries | 11 of 11 passed |
| Training and staffing | Staff trained, dual-control custodians named, open staff departures | 11 of 11 trained; no open departures |
What does a branch manager check in a self assessment?
The checks that need eyes: the opening procedure, alarm and hold-up buttons, cameras and the recorder, a surprise count of one teller drawer, the vault count, vault dual control, combinations and keys, the vault time lock, official checks, money orders and gift cards, the night depository, the cash recycler, bait packs and robbery kits, security training records, teller-line and lobby notices, member records secured, shred bins, the records room, the exterior, ATM and drive-up, the security program page and the manager's own observations. In the sample checklist that is 22 steps, one per screen on the manager's phone, each with a photograph.
Leah Okafor opened the review at 8:12 a.m. on Thursday 22 October. As she started the walk, the Review planner chose teller drawer 3 for the surprise count; nobody at the branch had seen the choice in advance. Drawer 3 counted $11,482.00 and the vault, counted by Leah and a second employee, $186,420.00, both equal to the teller platform. Why who chooses the drawer matters as much as the count is the subject of surprise cash count: when the branch knew it was coming.
Step 6: the vault log with one set of initials
At 9:02, step 6 of 22, Leah photographed the vault access log. The Reading agent transcribed the ten openings from 8 to 22 October; nine had two sets of initials. The Security agent laid the security system's records beside them: on Friday 9 October the alarm was disarmed at 7:49 a.m. with one employee's code, the vault door was open from 7:52 to 8:06, and nobody else entered the branch until 8:31. The vault balanced that evening at $201,860.00. The verdict on her phone read: "Exception, 1 of 10 openings: October 9, 7:52 a.m. has one set of initials (K.D.). Nobody else entered the branch until 8:31 a.m."
Two things about that verdict matter more than the finding. It came with its sources, the photo, the transcription and the security events, so it could be checked. And it was a proposal: Leah could agree, disagree with a reason code, or retake the photo. She agreed at 9:04. Because the same branch had a single-person vault opening on 28 May, the exception opened as high and a repeat, and the security officer was told the same day. Nothing was missing; the control had still failed twice.
One page of exceptions in Branch Self-Assessment at the end of the walk, then submit
What happens to exceptions found in a self review?
Each gets an owner, a due date by severity, reminders and an escalation path, and is closed only when a second person has checked the evidence. The walk finished at 9:46 with 62 of 64 checks passed. The vault exception went to Leah, due Monday 2 November under the ten-day rule for high severity, with a plan: coach the employee and collect a dual-control attestation from all 11 staff. The ID exception went to the member service representative who opened the membership, due Thursday 5 November under the 14-day rule for medium. A fogged drive-up camera went to facilities as an observation, not an exception. Leah submitted at 9:52.
The Follow-up agent then works the queue across all 38 branches. It reminds owners three days before the due date and escalates to the regional manager the day after it passes; repeats go to the security officer or the BSA officer. To close the vault exception, Leah proposes closure with a coaching note and the 11 attestations; the agent checks the signatures against the staff list; the regional manager or the security officer verifies and closes. The agent never closes anything itself. What the credit union learns from the queue as a whole, such as repeats by branch and closures with checked evidence, belongs on its branch scorecard.
Who reviews a branch self assessment?
A regional manager who did not perform it signs it, and internal audit can re-perform any part of it. At 3:40 p.m. the regional branch manager for the North region read the agents' cited summary, both exceptions and the photographs, including the vault log, the vault count sheet, the drawer 3 surprise count and a camera still, and signed. Cedar Hollow became the 12th of 38 fourth-quarter reviews signed. Leah could not have signed it herself: the sign button is disabled for the person who performed the review, and a review sent back to the branch carries a reason.
The evidence stayed with the review: 22 photos, 18 samples and 42 system checks, kept for the five years the credit union has set. Later, an internal auditor who reports to the Supervisory Committee picked Cedar Hollow, step 6, and re-performed it without a branch visit. She saw the stored photo without the agent's marks, judged it herself, then saw the original result (the Reading agent's version, its 96% confidence and the branch manager's agreement at 9:04) and recorded her conclusion next to it.
The trail of one day's review in Branch Self-Assessment: every action by people and agents
How long does a branch self assessment take?
On paper, about six hours of the branch manager's time for one quarterly review at the sample credit union, by our estimate, plus about two more hours of regional and internal audit follow-up; with the solution, about two hours of the manager's time. Leah's walk in the sample review ran from 8:12 to 9:46, and she submitted six minutes later. The estimate is ours, built from the solution's design figures for the sample credit union; it is not a measured customer result.
Where the branch manager's time goes on one quarterly review, with agents (estimate)
About 2.0 hours with Branch Self-Assessment
- Walking logs, alarm panel, cameras and notices · 40%
- Counting the vault and a drawer, consigned items · 25%
- Chasing owners and questions · 15%
- Checking file samples · 10%
- Writing up · 10%
The walk is the one part that does not shrink much, and should not. It is where the manager's eyes are the evidence: a fogged camera, a log line, a count. Everything around it, from pulling samples to typing up findings, is retrieval and writing that agents do faster and more consistently.
How often should branches do a self assessment?
No federal rule sets a frequency; the institution chooses one by risk, and quarterly is the cadence of the sample credit union, with one unannounced review per branch a year whose date the branch does not know. What the rules fix are the calendars the self-assessment feeds. A bank's security officer reports to the board on the security program at least annually, and a credit union's president certifies its Part 748 security program every year in the Credit Union Profile; quarterly branch reviews give both a year of evidence rather than one look. The rules for each regulator are set out in Bank Protection Act requirements in plain words.
Staffing affects frequency too. The FDIC expects every officer and employee to be away from their duties for at least two weeks in a row each year, because embezzlements "usually require a perpetrator's ongoing presence" (FDIC RMS Manual, section 4.2; why the absence only works if someone else does the job is in how to prevent embezzlement at a bank branch). A self-assessment can check that control indirectly: who covered each drawer while its teller was away, and whether the vault's dual-control custodians are the people named. In the sample review the Review planner checked that dual-control custodians were named and that no staff departures were open.
How is a self assessment different from an audit?
A self assessment is the business line checking itself; an audit is a test by people without business-line responsibilities. That is the distinction the Federal Reserve's manual draws, and it is why the sample credit union keeps three roles apart: the branch manager performs, the regional manager signs, internal audit re-performs. Cash itself is a specialist subject, from daily balancing to the cumulative over-and-short record examiners ask for, covered in our sister series on balancing, teller balancing and the cumulative record; the self assessment samples it rather than replacing it.
A good self assessment makes the audit cheaper rather than redundant. When every step leaves a photo or a system extract, internal audit can test a sample of steps across many branches from its desk and spend its branch visits where the evidence is weakest or the reviewers disagree. The branch audit checklist sets out the evidence each item should leave.
From 38 branch reviews to the board report
Every signed review feeds the annual security program report. Before the board's 18 November meeting, the Roll-up agent drafted the credit union's 2026 report from the year's signed reviews, every number linked to its evidence: exceptions by quarter, alarm tests recorded (342 of 342 monthly tests to the end of September), training completion and the two single-person vault openings at Cedar Hollow. The security officer reviews it and the vice president of member experience approves it; the agent never sends anything to the board and never certifies. The certification draft for the Credit Union Profile goes to the president and chief executive after the meeting. The design target for the program as a whole is to halve repeat findings within a year and to close every exception only on checked evidence. The solution is at Branch Self-Assessment.
Questions people ask
What is the purpose of a branch self assessment?
To test the branch's controls between audits, find problems while they are small, and give internal audit and examiners evidence they can rely on. Its weakness is that management is checking itself, so it needs re-performable evidence and a reviewer who did not perform it.
Who should sign a branch self assessment?
Someone senior to the branch manager who did not perform it, such as a regional manager or an operations officer. In Branch Self-Assessment the performer cannot sign, and in the sample configuration the regional manager signs within ten business days of submission.
What records does a branch self review sample?
Typically new-account customer identification files, currency transaction reports, Regulation CC exception hold notices and records with retention periods, compared with the core and the BSA reporting system. The sample credit union takes five, three, four and six of each per quarter, or all of them if there are fewer.
Can a branch self assessment be done without signal in the vault?
In Branch Self-Assessment, yes: with offline capture on, photographs are stored encrypted on an institution-managed phone and sync when there is signal. They go only into the review, never to the phone's camera roll.
What happens if a branch keeps failing the same check?
It becomes a repeat finding: in the sample configuration the Follow-up agent flags repeats across quarters and branches, and they go to the security officer or the BSA officer as well as to the branch's owner. Repeats by branch and by checklist item are the first line of a control scorecard.