Compliance testing vs audit: two jobs examiners judge separately

Compliance testing and compliance audit both check transactions against consumer rules, which is why they are confused. The difference is whose check it is. Compliance testing, part of monitoring, is management's own routine proof, run by compliance or the business on a schedule it sets, so problems are found and fixed quickly. Audit is an independent assessment, by people with no stake in the areas they review, of whether the compliance program as a whole works, including the testing. Examiners look at both and rate the bank on whether, together, they catch what matters. Botminds' Consumer Compliance Testing sits on the testing side and is built so an auditor can re-perform any result from its trail.

What is the difference between compliance testing and audit?

Independence and purpose. The FDIC's examination manual describes an audit as "an independent assessment and validation of an institution's system of internal controls, operations, and compliance risk management framework" that "complements the institution's monitoring system" (FDIC Consumer Compliance Examination Manual II-3, June 2019). Testing belongs to monitoring: it is how management finds weaknesses as they happen. Audit asks whether management's monitoring, testing, policies, training and complaint handling are adequate, and tests enough transactions to know.

The OCC draws the same line in its compliance management booklet: monitoring is more frequent and less formal than the independent review performed by the audit function, and monitoring and testing staff may have less independence than audit staff, depending on the bank's size, complexity and risk (OCC Comptroller's Handbook, Compliance Management Systems, version 1.0, June 2018). The CFPB's examination manual says much the same, adding that monitoring may be carried out by the business unit itself (CFPB Supervision and Examination Manual, November 2025).

Is compliance testing second line?

In most banks, yes: compliance tests what the business did. The regulations and exam manuals do not use the three lines labels, and they do not need to. What they require is that someone other than the person who did the work checks it, and that someone independent of both checks the program. Compliance testing meets the first condition; audit, the second.

Inside testing there is a second separation that examiners also look for: the person who prepares a finding should not approve it. In Consumer Compliance Testing that is a rule, not a habit. The analyst confirms exceptions and prepares the finding; only the compliance manager can approve it, and the screen says so to the person preparing it.

Prepared by the analyst, approved by the manager: the line inside testing

Does internal audit test consumer compliance?

It should, and with real transactions. The FDIC is direct about the standard: "Generally, a strong consumer compliance audit will incorporate vigorous transaction testing" (FDIC II-3). The board sets the scope and frequency, weighing transaction volume, product complexity, complaints, branches, staff turnover and outsourced functions, and the audit may run once a year or continuously on a staggered basis.

The OCC lists what audit coverage of a compliance program should include: independent and qualified auditors; testing of internal controls to identify inaccurate or unauthorized transactions, violations and deviations from policy, including thematic issues and their root cause; evaluating policies and procedures; and a last item that reads: "Reviewing and validating management actions to address material consumer compliance-related weaknesses" (OCC, Compliance Management Systems). That last item is where the two jobs meet: audit checks that what testing found was actually fixed.

Can compliance test its own work?

It can check its own work, but not audit it. Testing staff re-perform each other's work, managers review workpapers, and a well-built program re-tests a share of its results blind. None of that makes it independent of itself. The Federal Reserve's examiners add that internal auditors "should not have management or operational responsibilities that could result in a conflict of interests and hinder their independence" (Consumer Compliance Outlook, 2013), which rules out a compliance officer auditing a program they run.

Agents do not change that arithmetic. Agents that compliance configures and runs are part of compliance's monitoring, however many re-tests they perform. What they change is how much there is for audit to read: every population with its reconciliation, every attribute with its citation, every decision with a reason code and a name.

Do small banks need both?

Usually, in some form. The FDIC treats each function as playing a different role, and warns that strong monitoring does not by itself show that risks are under control; many institutions need both (FDIC II-3;the FDIC signage audit guide applies the warning to one rule). The CFPB allows that a small, non-complex institution with low-risk products may have only one, provided coverage matches its risk.

In practice small banks often combine light in-house monitoring with an outsourced audit, which is reasonable as long as the outside firm is independent of the monitoring and the board receives its report directly. Compliance exam preparation at a community bank covers how a one-person department organises that, and compliance testing services, in-house or agents prices the options.

Audit asks whether the testing can be relied on. The testing has to be built so that question can be answered.

How examiners rate each

Together, inside the compliance program. The interagency rating system revised in 2016 explains why: when the original system was adopted in 1980, "examinations focused more on transaction testing for regulatory compliance rather than evaluating the sufficiency of an institution's CMS" (FFIEC Uniform Interagency Consumer Compliance Rating System, 81 FR 79473). The revised system rates the program, with monitoring and audit as one factor, and weighs any violations by root cause, severity, duration and pervasiveness.

It also rewards a bank for finding its own problems. A bank can still receive a 1 or 2 rating when violations occurred if, among other things, they did little harm to consumers and the bank found and fixed them itself, and quickly (81 FR 79473; how remediation earns that credit is inwhat customer remediation in banking is). Self-identification is testing's job. An audit that finds what testing missed is evidence the testing is weak; testing that finds a problem first, with its cause and its reach, is evidence the program works.

Who reports compliance audit findings to the board?

The auditor, directly. The FDIC expects audit findings to be "reported directly to the Board or a committee of the Board", whether the audit is done in-house or by a contractor, and lists what the written report should include: the scope, the deficiencies, the number of transactions sampled by product type, and corrective actions with time frames (FDIC II-3). The compliance officer receives a copy and acts on it, and management should verify later that the corrective actions held.

Testing findings take the other route: to the compliance officer, who reports compliance activity to the board. The board therefore hears the same issue twice when the program works, once from testing as it is found and fixed, and once from audit as it is validated.

What an audit of the testing program re-performs

Auditors judge testing by redoing a piece of it. A typical review picks some tests and, for each, checks the population against an independent count, re-performs a selection of items from the cited evidence, confirms the attributes match the rule in force on the test date, and follows a finding through its issue to the validation re-test. The CFPB's procedures look at the audit program's own reach too: whether its scope covers previous audit and exam findings, new requirements, new products and channels, and the areas the institution itself has flagged as higher risk (CFPB Supervision and Examination Manual, November 2025).

For a testing program run with agents, the re-performance is the same with one addition: the auditor should see how the agents' accuracy is measured and what happened to every disagreement between them. A blind re-test rate, reported by script, is evidence an auditor can sample like any other.

When audit and testing disagree

It happens, and a good record makes it useful. If audit finds an exception that testing passed, the first questions are whether the attribute was tested at all, whether the evidence was there, and whether the reader got it wrong. The answers point to different fixes: a missing attribute is a script change, missing evidence is a data problem, and a wrong reading is an accuracy problem to measure and correct. Each can only be told apart if the testing record holds the evidence and the reason for every call, which is the point of keeping both.

How the two calendars fit together

Testing runs quarterly or monthly; audit on an annual or rotating cycle the board sets, and the FDIC notes an audit may run once a year or continuously across products and branches on a staggered basis (FDIC II-3). They fit best when audit's cycle uses testing's output: it samples the quarters testing ran, re-performs a share, validates the closed issues, and adds its own testing where testing's coverage is thin. A bank whose audit and testing sample the same holds at different times, without reference to each other, pays twice for one answer.

Where agents fit on each side

On the testing side, agents do the mechanical work: pull and reconcile populations, read every notice beside the core record, re-test blind, group exceptions by cause, draft workpapers and track issues. People confirm, approve and close. On the audit side, agents change what audit receives, not who audits. In Botminds' Consumer Compliance Testing every agent step and every person's decision is on a trail that cannot be edited, with a reason code and the evidence it rests on, and an internal audit pack or an examiner pack is one export.

An auditor can then do what audit is for: pick results, re-perform them from the cited evidence, check that the script versions match the rule, and confirm that a fix was re-tested before the issue closed. Testing that cannot survive that is weak testing, by hand or by agent. The Consumer Compliance Testing page shows the trail; monitoring and testing, task by task shows what each agent may and may not do.

What audit reads: every step, with its reason and its evidence

Questions people ask

What is compliance monitoring?

Management's continuing check on compliance: scheduled reviews of disclosures, notices, advertising and transactions, complaint analysis, quality control in the business and testing. Its aim is to find procedural or training weaknesses early enough to prevent violations.

Is internal audit part of the compliance program?

It is part of the compliance management system but independent of the compliance function. The FDIC lists monitoring and audit together as one component of a compliance program, and expects the audit to be performed by people independent of what they review.

How often should a consumer compliance audit be done?

As often as the board decides the risk requires. The FDIC notes an audit may be done once a year or run continuously, covering products, operations and branches on a staggered basis, with scope driven by volume, complexity, complaints, turnover and changes.

Can an outside firm do both testing and audit?

Not for the same area without compromising audit's independence. A firm that runs your monitoring cannot then be the independent check on it. Many banks use one firm for audit and keep testing in-house, or use separate firms.

What is the difference between compliance testing and control testing?

Compliance testing checks transactions against a rule's requirements: did this notice say what Regulation CC requires? Control testing checks whether a control works, such as whether the teller platform prints the current form. Good compliance testing finds failed controls through their effects, and the cause analysis then names the control.