A compliance testing manager's quarter, week by week

A compliance testing manager owns the bank's routine proof that its deposit and payment operations follow the consumer rules: that exception holds kept back only what Regulation CC allows, that Regulation E error claims were credited and answered on time, that Regulation DD disclosures and notices went out. The manager sets the testing schedule, keeps the test scripts current, decides how each population is tested, reviews the analysts' workpapers and turns exceptions into findings someone has to fix. The hard part is time: in a sampled quarter most weeks go on extracts, document pulls and paperwork, so findings arrive long after the errors began. Botminds' Consumer Compliance Testing exists to hand that mechanical share to agents and leave the manager's weeks for the decisions.

In a sampled quarter, most of the hours go on getting each item in front of a person, not on the judgement that person is there to make.

What does a compliance testing manager do in a bank?

The title belongs to the industry, not the regulators: rules and exam manuals describe the work and leave the job names to banks. The FDIC's examination manual lists what any compliance officer is responsible for, regardless of bank size, including developing and reviewing policies and procedures, training staff, "reporting compliance activities and audit/review findings to the Board" and making sure corrective actions are "effective at preventing recurrence" (FDIC Consumer Compliance Examination Manual II-3, June 2019). In a bank big enough to separate the roles, the testing manager carries the middle of that list: the reviews themselves.

Concretely, that means five things. A schedule of which tests run when, set by risk. A library of test scripts, each tied to the rule sections it checks. A decision for every test about the population and the method: a sample, and how big, or every item. Review of the workpapers the analysts produce. And the step from exception to finding, with a cause, a severity, an owner and a due date. The OCC asks for the first of these in writing: the plan and schedule for monitoring "should be risk-based, documented, and updated at least annually" (OCC Comptroller's Handbook, Compliance Management Systems, version 1.0, June 2018).

Examiners read that schedule. The CFPB's procedures have them ask for the monitoring schedule covering the review period and the coming year, and check whether reviews in progress are on time against it (CFPB Supervision and Examination Manual, November 2025, Compliance Management Review). A testing manager is therefore judged twice: on what the tests found, and on whether the program ran the way its own plan said it would.

Where a testing quarter's weeks go

Testing runs a quarter behind the business. The holds placed in July, August and September are tested in October and November, so a manager's quarter has two halves: about six weeks of running last quarter's tests through to approved findings, and the rest spent on what those findings set in motion. Take a fictional sample bank, Tessaly Community Bank, with 41 branches, 14 test scripts across Regulations CC, E and DD and two analysts. Its second quarter of 2026 was tested the traditional way: about 60 items a script, 840 in all, with an outside reviewer, and it took 31 business days from the run to approved findings.

Read the first lane the way a testing manager lives it. Days 1 to 9 are requests: an extract for each script from the core, the dispute system or the mail vendor, then a sample drawn, then a list of notice images and claim files sent to the people who keep them. Days 10 to 19 are reading, one notice beside one core screen at a time. Days 20 to 24 are workpapers and screenshots. Only the last seven days are about what the tests mean, and four of those are the manager's own review.

Weeks 1 to 3: the schedule, the scripts and the populations

The quarter opens with three questions the manager answers before anyone tests anything. Which scripts run this quarter? Do any scripts need to change because a rule or a product changed? And is each population complete?

Rule changes land here. On July 1, 2025 the Regulation CC next-day amount rose to $275 and the large-deposit threshold to $6,725 (12 CFR 229.11), so every hold test after that date needs the new numbers, and so does every hold notice form the branches print. A script change is a controlled change: the manager approves it, and the old version stays on file so an examiner can see what was tested when. Testing Reg CC availability after the July 2025 change works through what that means for the hold scripts.

Populations are the quiet risk. A test is only as good as the list it runs on, and an extract that drops a branch or a day of claims will pass every item it contains. The OCC's examiners are told the same about their own samples: "If the population is not appropriately specified, the resulting inference based on a sample from that population could be flawed" (OCC Comptroller's Handbook, Sampling Methodologies, version 1.0, May 2020). A good manager reconciles every extract to a count kept somewhere else, such as the core's daily hold report, the claim register or the fee line in the general ledger, before a single item is read.

When guidance is withdrawn, the script library changes too

Rules are not the only thing that moves a script. On May 12, 2025 the CFPB withdrew a list of 67 guidance documents, among them its circular on unanticipated overdraft fees, its circular on overdraft opt-in practices and its bulletin on fees for returned deposited items (Federal Register, 90 FR 20084). On April 10, 2026 the FDIC rescinded its guidance on fees for re-presented items, judging it too broad (FDIC FIL-14-2026). A test whose attributes were cited to those documents has to be re-cited to a rule that still binds, or retired, and the change approved and versioned like any other.

What stays is the regulation. The Regulation E opt-in rule did not change: a bank may not charge a fee for paying an ATM or one-time debit card overdraft unless the customer affirmatively opted in after a proper notice and got a written confirmation (12 CFR 1005.17(b)). At the sample bank, the overdraft script tests exactly that on every such fee in the quarter, 836 of them, reconciled to the fee line in the general ledger. Telling the two kinds of citation apart is a testing manager's job; which CFPB guidance was withdrawn in 2025 is set out in full on its own page.

Weeks 4 to 7: samples, document pulls and reading

Sampling is where most testing programs spend their judgement and most of their calendar. The familiar 60 items is not arbitrary: it sits just above the 59 that the OCC's own sampling table gives for 95% confidence that an exception rate is below 5% (OCC, Sampling Methodologies, table 1). That answers a narrow question well. It does not find an error confined to a few branches, a point what full population testing is, and what a 59-item sample can prove takes apart with the arithmetic.

The reading is the slow part because the evidence lives in two places. The core says what the bank did: the hold code, the amount held, the release date. The notice image says what the customer was told: the amount delayed, the reason, the date the funds would be available. A Regulation CC hold test needs both on the same desk, so every sampled item is a request to imaging, a wait, and then a side-by-side reading. Regulation E claims need a third source, the call notes, because the clock starts when the customer first reported the error, not when someone keyed the claim.

Weeks 8 to 10: workpapers and the exception call

A workpaper is the test's memory. It states the objective, the population and how it was counted, the method, each attribute with the rule section it checks, the evidence for every failure, the conclusion and who signed. Its audience is not the analyst who wrote it but the manager, internal audit and, later, an examiner who was not there. The FDIC's description of a written compliance audit report sets the floor for what that reader expects to find, including the "number of transactions sampled by category of product type" and suggested corrective actions with time frames (FDIC II-3).

The exception call is the judgement the whole quarter exists for. Is a hold notice that lists the right amount but the wrong reason an exception? Is a notice the branch cannot find a failure, or missing evidence? Is a Reg E claim on business day 11 late if the core says it was keyed on day 9? These are the analyst's calls and the manager's review, and in a sampled quarter they compete for time with the typing.

Clearing an exception deserves the same care as confirming one. At the sample bank, three of the nine exceptions in the third quarter's hold test were confirmed as isolated: a notice mailed one business day late, a repeated-overdrafts reason the account history did not support, and a notice the branch could not produce. Each was reported to its branch manager with a reason code and no finding, because none shared a cause with anything else. Recording why an exception is isolated is what lets the manager, and later an examiner, see that it was judged, not waved through.

The analyst's quarter on one screen: what was tested and what needs her today

Weeks 11 to 13: causes, findings and the report to the board

A finding without a cause is a count, and examiners rate the cause. The interagency rating system weighs every violation on four factors: root cause, severity, duration and pervasiveness. On duration it is blunt: violations "that persist over an extended period of time will raise greater supervisory concerns than violations that occur for only a brief period of time" (FFIEC Uniform Interagency Consumer Compliance Rating System, 81 FR 79473). A finding that reaches the manager six weeks after the quarter has already added six weeks to its own duration.

The last weeks also carry the work the findings start: issues opened with the business, refunds where customers paid fees, a validation re-test once the fix is in, and the committee or board report. Then the schedule for the next quarter, and the cycle starts again. The FDIC expects management to check later that corrective actions held, which is why how a fix is validated by testing matters as much as how the exception was found.

Who reviews compliance testing workpapers?

Three readers, in order. The testing manager reviews every exception and every finding before anything leaves compliance, and the person who prepared a finding should not be the one who approves it. Internal audit reviews the program independently, on its own schedule, and decides whether the testing can be relied on. Compliance testing and audit are two different jobs for exactly that reason. Examiners read the workpapers last, usually a selection, to decide how much of their own testing they can skip.

The OCC's procedures show what examiners look for when they assess "the compliance monitoring and testing function": frequency and scope, "the transaction sampling methodology", the qualifications of the staff, reporting to the board, and "whether findings include a root cause determination and are corrected in a timely and appropriate manner" (OCC, Compliance Management Systems). A workpaper that cannot answer those five questions on its own will be answered for it.

A finding approved by someone who did not prepare it

What skills does a compliance tester need, and what does the job pay?

The skills are the rules, the systems and the judgement between them. A tester has to know Regulations CC, E and DD well enough to turn a section into a check, know where the core, the imaging system and the dispute system keep each fact, and know when an odd item is an exception and when it is missing evidence. Writing matters more than it looks: a finding has to be clear to a branch manager and defensible to an examiner.

Pay data for the specific title does not exist in federal statistics. The federal occupation series that covers compliance officers of every kind reported a median of $80,730 a year in 2025, across 436,400 jobs, banking and non-banking alike (O*NET OnLine, compliance officers, 13-1041.00). For a bank, people are most of what compliance costs: in a Federal Reserve Bank of St. Louis study of 2014 community bank data, personnel was more than 60% of compliance expense in every size group (St. Louis Fed, Regional Economist, July 2016). That is why the shape of the tester's week, and how much of it is typing, is a cost question as well as a quality one.

The same quarter with agents doing the reading

In Botminds' Consumer Compliance Testing the manager's quarter keeps its shape and loses its waiting. Agents pull each script's whole population and reconcile it before testing; a short count stops the test. They read every notice and letter image beside the core record and decide each attribute, citing the rule and the record for every failure. A second agent on a different model family re-tests every exception and a random 5% of passes without seeing the first answer. They group exceptions by cause, run the look-back and draft the workpapers and the finding. Nothing leaves without the analyst's confirmation, and only the manager approves.

On the sample bank's third quarter that meant 9,012 items tested, every item in 10 of the 14 scripts, and 19 exceptions, each with a workpaper. Six of the nine exceptions in one Regulation CC test turned out to share one cause, a retired notice form still printing at two branches; the look-back found 21 more holds since July 2025. The people below kept their jobs and changed their weeks. How the work splits, task by task, between agents and people covers the division in detail; the Consumer Compliance Testing page shows each screen.

Questions people ask

What does a compliance testing analyst do?

The analyst runs the tests: requests each population, draws the sample or works the full population, reads each item against the rule and records the result with its evidence. The analyst also makes the first exception call and drafts the workpaper; the manager reviews and approves. At the sample bank, two analysts cover 14 scripts a quarter.

How often are consumer compliance tests run?

As often as the risk calls for, which most banks translate into quarterly tests for high-volume deposit rules such as exception holds and Regulation E claims, and annual or event-driven tests for the rest. The OCC expects the monitoring plan to be risk-based, documented and updated at least annually; the FDIC adds that reviews matter most after a regulation change, a new product or a past finding.

How long does a Reg CC test take?

By hand, the reading is the long part: each sampled hold needs the core record and the notice image side by side, and the notice has to be requested from imaging. On the sample bank's estimate, reading alone took 10 of the 31 business days a sampled quarter needed. With agents reading every image, the design target for the whole quarter is about 9 business days.

How independent must a compliance testing manager be?

Less than an auditor, more than the business. In most banks testing sits in the second line, testing what the business did; regulators do not require the three-lines labels, but they do separate monitoring from audit (the two jobs are set side by side in compliance testing vs audit). The OCC notes that monitoring and testing staff may have less independence than auditors, depending on the bank's size, complexity and risk.

What is a compliance testing schedule?

It is the plan of which tests run when, set by risk and approved by management with the board's input. It lists each script, its frequency and its last run. Examiners ask for the schedule for the review period and the next 12 months, and compare it with what was actually done.

Who should a compliance testing manager report to?

Usually the chief compliance officer, who reports findings to the board or a board committee. The FDIC expects the compliance officer to have enough authority and independence to cross departmental lines, see every part of the operation and get corrective action taken, and that independence is what makes the testing manager's findings stick.