Regulatory reporting quality assurance is the review, done after a report is filed, that checks whether the bank's own standards and controls were actually followed while it was prepared: whether the second reviews happened, whether overrides were approved, whether sign-offs were given. It is the partner of quality control, the independent check done before filing that catches errors in the report itself. Both matter most on the Call Report, which every insured bank files within 30 days of each quarter's end, and both depend on evidence that most reporting teams keep in email and spreadsheets. Botminds' Call Report Analysis is an agentic solution that produces that evidence as the work happens: agents run the edits, tie every swing to its source and challenge every explanation, a person accepts, a different person approves, and every step is on one trail that the quality assurance reviewer reads after filing.
The sample figures on this page come from the solution's fictional sample bank, Corvane National Bank. The go-live plan is our proposal, with our estimates of time, not a measured result.
Quality control and quality assurance in regulatory reporting are two different reviews
Quality control: Concurrently with the work, before filing.
Quality assurance: After the bank has filed the report.
Quality control: The report: is this figure right, is this explanation supported?
Quality assurance: The process: did the controls the policy requires actually operate?
Quality control: An independent party: a second reviewer, internal or outsourced, trained in the bank's process.
Quality assurance: An independent party, separate from both preparer and reviewer.
Quality control: A reviewer checks data from manual or automated feeds before filing.
Quality assurance: A reviewer checks that no automated feed was overridden without the required approval.
Quality control: Corrections before the report goes.
Quality assurance: Findings on weaknesses, risks, training needs and process gaps.
What is regulatory reporting quality assurance?
It is a check on the checking. The OCC's examiner booklet describes it as a review "designed to verify that established standards and processes are followed and consistently applied," performed by an independent party, and adds the distinction that matters: "quality assurance is conducted after the bank has filed the regulatory report" (OCC, Regulatory Reporting). Its example is specific. The reviewer "assesses whether controls, such as the inability to override automated data feeds without the appropriate approval, occurred as required by bank policy," and may check that the required sign-offs took place.
The output goes to management, not to the report. Management uses the results, the booklet says, to assess the bank's policies, procedures and practices for regulatory reporting and to "identify operational weaknesses, risks associated with regulatory reporting, training needs, and process deficiencies." Quality assurance is how a desk learns from a quarter before the examiner does it for them.
What is the difference between quality control and quality assurance in regulatory reporting?
Quality control is done before filing and corrects the report; quality assurance is done after filing and corrects the process. The OCC defines quality control as assurance that the bank "consistently applies standards, complies with laws and regulations, and adheres to policies and procedures," performed "concurrently with the bank activity and before filing," through secondary reviews and sign-off requirements. An effective process, it says, "significantly reduces or eliminates errors before they become systemic issues."
The two depend on each other. A quality control step that leaves no trace cannot be assured afterwards; a quality assurance review with nothing to read becomes a reconstruction from memory. On a Call Report desk the controls in question are few and concrete: was every quality edit that still fails explained, did someone other than the preparer review each explanation and each correction, were any data overrides approved, and did the signatures come before submission.
Who should perform regulatory reporting quality control?
Someone independent of the preparer who knows the bank's process. The OCC allows either: "The quality control review may be performed internally or outsourced to a third party. Regardless, the independent party performing the review should be trained and familiar with the bank's regulatory reporting process." At most banks the reviewer is the regulatory reporting manager or a controller; at small banks it may be a second accountant or an outside firm.
Independence is a design question, not a job title. A manager who approves an explanation he drafted, or a correction he proposed, is not independent of it, however senior. In the sample bank the solution enforces the rule rather than relying on it: the manager's approval queue shows his own proposed correction, a $3.4 million reclassification of overdrawn deposit accounts, and will not let him approve it.
What should a regulatory reporting QA review check?
It should check that each control the policy names actually ran, using evidence produced at the time. The OCC tells its examiners what to consider when they assess a bank's quality control and quality assurance: the types of review, the independence and training of reviewers, the timing, the results, how the results are used, and who receives the reports. The checklist below turns that into questions a QA reviewer can answer for one Call Report quarter.
Nine checks for a quality assurance review of one Call Report quarter
- Every failing quality edit was explained, or corrected
Compare the final edit run with the filed explanations; none missing, none empty.
- No explanation was approved by the person who accepted it
Read the accept and approve entries for each; two names every time.
- No correction was approved by the person who proposed it
The same test on every change to a reported figure.
- Every override of a check had a reason and an approval
The OCC's own example: no automated feed overridden without approval.
- Recurring explanations were rechecked, not copied
Each carried-forward explanation shows a recheck against this quarter's data.
- Escalations happened on the day the policy sets
Unresolved items reached the manager in time to be reviewed properly.
- Signatures were dated before submission
The General Instructions require the date of signing to show the signature came first.
- The workpapers support every reported line sampled
A sample of lines traced to the general ledger and subledgers, as an examiner would.
- Findings went to someone who can act on them
Who receives the QA report is one of the OCC's own considerations.
The next window: December 31, 2026, filed by February 1, 2027
The next Call Report window opens on January 1, 2027, and a go-live plan should aim at it. The December 31, 2026 report is due 30 days later, on Saturday, January 30, 2027. Because that falls on a weekend, the agencies give institutions the option to submit on Monday, February 1, 2027; banks with more than one foreign office have until Thursday, February 4. The March 31, 2027 report is due Friday, April 30 (FDIC FIL-62-2026).
The year-end report is a demanding first live quarter. Income statement items are reported year to date, so December carries the full year; some items are collected only once a year, such as international remittance transfers in Schedule RC-M, reported as of December 31; and the window overlaps the year-end audit. That argues for going live with settings that have already been proved on a quarter the bank knows well, which, at the end of October 2026, is the September 30 report the bank has just filed.
How long does it take to set up regulatory reporting QA? A plan in weeks
About nine weeks before the window, in our plan, followed by the live window itself and a quality assurance review after filing. The order matters more than the speed: decide the standards first, connect the sources second, prove both on the quarter just filed, and only then go live.
From the September filing to the first live window, week by week
- Standards2 wk
- Connect sources2 wk
- Replay Q3 20263 wk
- Sign-off1 wk
- Close1 wk
- Drafts, edits, explanations3 wk
- Review, release, sign1.5 wk
- QA review2 wk
Weeks 1 and 2: standards. Write down what the quality control will enforce: the bank's house checks beside the FFIEC edits, the swing thresholds that trigger a decomposition, the largest residual an explanation may leave, the required parts and banned phrases of an explanation, the escalation day, and who accepts, approves, releases and signs. Weeks 3 and 4: sources. Read-only connections to the general ledger, the loan, deposit and securities subledgers, the core banking system, document imaging and the regulatory reporting system the bank already files from.
Weeks 5 to 7: replay the September 30 quarter. Run the edits and the drafting on the drafts the bank actually had, then compare: did the agents find the drivers your team found, did any draft claim a cause with no source, did the challenges land on real problems, and would any explanation have needed rewriting? Week 8: sign-off. Settings frozen, each change approved by a second administrator, the team trained on the queues. Week 9 belongs to the year-end close.
Decide the standards before day one
Most of what makes quality control work is a decision a bank can take in a meeting: the thresholds, the wording rules and the approval roles. Writing them down before the window, as settings that are versioned and approved, is what lets a QA reviewer later test whether they ran. The sample bank's settings are a reasonable starting point.
The quality control settings to agree before the first live window
| Setting | Sample bank | Who should own it |
|---|---|---|
| House checks beside the FFIEC edits | 140 | Head of regulatory reporting |
| Swing that triggers a decomposition | 10% and $5M quarter over quarter; 20% and $10M year over year | Manager, with the controller |
| Largest residual an explanation may leave | $0.25M or 2% of the movement | Manager |
| Required parts of an explanation | Why, amounts, dates, instruction reference | From the FFIEC guidelines |
| Banned phrases | 8: six from the FFIEC guidelines' list, two of the bank's own | Manager |
| Escalation day | Day 20 of 30, to the manager with a copy to the Head | Head of regulatory reporting |
| Who accepts, approves, releases, signs | Analyst; a different manager; the Head; the CFO function and directors | Board policy |
| Change control on the settings | Each change versioned and approved by a second administrator | Second line or audit |
The explanation rules, as settings that are versioned and approved
What to measure in the parallel run, and the pass marks to set first
The replay should end in numbers agreed in advance: how many failing edits the drafts covered, how many drafts needed rewriting, how many explanations would have gone with a residual above the limit, how many challenges were false alarms, and how many days the window would have had to spare. The sample bank's own quarter shows the shape such a run produces.
Three drafts took the sample quarter from 143 failures to 38 explanations
Set the pass marks before the run. Ours would be: no draft accepted with a driver that has no source; no residual above the limit; every recurring explanation rechecked; the set ready for release with at least three days to spare, which is the solution's design target; and a false-alarm rate low enough that analysts do not learn to overrule the challenges by reflex. The trace of one failed edit shows what each of those looks like for a single item.
The window, with its escalations and targets
Can regulatory reporting QA be outsourced?
The review can be; the responsibility cannot. The OCC allows a bank to use a third party for quality control or quality assurance reviews, or to audit its regulatory reporting process, provided the relationship sits inside the bank's third-party risk management. The General Instructions are equally clear that responsibility for the accuracy of the Call Report stays with the bank, whatever software vendors, servicers or outsiders do for it.
The same holds for software. A solution that runs the quality control steps is a tool the reviewers use, not a reviewer: in Call Report Analysis the agents never change a figure, accept, approve, release or submit. What changes is what a quality assurance reviewer can read after filing. Instead of reassembling the quarter from email, the reviewer filters one trail by item, person or agent and sees each step with its time and evidence. Internal audit's periodic Call Report audit, which the OCC describes as testing a sample of Call Report data and assessing internal controls, reads the same trail. Why the controls are worth the trouble, in money, is set out in what one call report error costs; the sample quarter itself is on the Call Report Analysis page.
Questions people ask
When is the December 31, 2026 Call Report due?
The due date is Saturday, January 30, 2027, and because it falls on a weekend institutions may submit on Monday, February 1, 2027. Banks with more than one foreign office, other than shell branches or IBFs, have until Thursday, February 4, 2027.
Is quality assurance required for the Call Report?
No regulation names a quality assurance review for the Call Report as such. But the OCC's examination procedures assess the effectiveness of a bank's quality control and quality assurance activities, including their independence, timing and results, so a desk with neither has a finding waiting to be written.
How often should regulatory reporting QA be done?
Every quarter for the Call Report is the natural rhythm, shortly after filing, while the people and the evidence are fresh. The OCC lists the timing of reviews among the things examiners consider, alongside independence and how the results are used.
What is the difference between quality assurance and internal audit in regulatory reporting?
Quality assurance is a management control run after each filing; internal audit is the independent third line that periodically tests the whole control system, including QC and QA. The OCC notes that at most banks without a separate risk organisation, audit coverage takes in quality assurance and quality control activities.
Can a bank go live with new review software in the middle of a quarter?
It can, but a first live window is safer when the settings have been proved on a quarter already filed. Replaying the September 30 report in November lets a bank compare the tool's work with what it filed and what its Call Report analyst accepted, before the December report depends on it.