Remediation testing in audit: proving every refund would hold up

Remediation testing in audit is internal audit's independent test of a customer remediation before the issue is closed and the bank reports it complete: that the affected population was complete, that each refund was calculated correctly under the approved method, and that the money actually reached each customer or has a lawful final state. It is hard because the evidence sits in different places, from the core's posting history and the archive to the check vendor's files, the returned-mail queue and the general ledger, and because the team's own spreadsheet is not evidence. Botminds' Customer Remediation keeps the working for every account and gives internal audit a read-only agent that re-performs a blind sample, rebuilds the population on its own and ties the program to the general ledger.

The rule that frames the work comes from the OCC's audit handbook: “When an issue owner indicates that work to address the issue is completed, the internal audit function should perform validation work before considering the issue closed” (Comptroller's Handbook, Internal and External Audits). A remediation is an issue like any other, with one difference: its failure is measured in customers who were not paid.

What is remediation testing in audit?

It is the third line's re-performance of the remediation, done after the team says it is finished and before management closes the issue. The Federal Reserve's supplemental audit guidance puts it plainly: “Internal audit should monitor management’s corrective action and conduct a follow-up review to confirm that the recommendations of both internal audit and the audit committee have been addressed” (Federal Reserve SR 13-1). The FDIC asks for the same thing from the compliance side, describing follow-up procedures “to verify, at a later date, that the corrective actions were lasting and effective” (FDIC Consumer Compliance Examination Manual II-3).

Enforcement orders often write the test in. The CFPB's 2022 order against U.S. Bank required that “Within 180 days after completing the Redress Plan, Respondent’s Corporate Audit Services department must review and assess compliance with the terms of the Redress Plan and validate that the Redress Plan has been properly executed” (CFPB Consent Order 2022-CFPB-0006; terminated August 21, 2025, after the Bureau recorded that redress payments were issued, CFPB). The OCC's 2016 order against First Niagara gave its internal audit department 90 days from the end of reimbursement to do the same (OCC AA-EC-2016-64, since terminated).

Three things audit tests: completeness, calculation and delivery

Each question fails differently, so each needs its own test. Completeness fails silently: a customer missing from the population leaves no trace in the payment file, the letters or the general ledger. Calculation fails systematically: one wrong day count or rate applies to every account. Delivery fails at the edges: returned mail, deceased owners, a check cashed by someone other than the payee.

That is why the design of the audit matters more than its size. A large sample drawn from the payment file tests calculation and delivery well and completeness not at all. The Independent Foreclosure Review, the largest remediation the banking agencies have run, still ended with its inspector general unable to confirm that everyone in scope had been found. Why two population builds must agree sets out how to test completeness before payment; the rest of this guide covers the closing audit.

How does internal audit test a remediation?

In four passes: review the design, re-perform a sample from source, trace payments to their final state, and tie the whole program to the general ledger. The design review asks whether the scope, lookback, method and exclusions match what management and, where there is one, the regulator approved. Re-performance rebuilds sampled refunds from raw postings and the approved method. Tracing follows each sampled payment to a credit, a cleared check, a reissue or a state report. The tie-out proves the totals: refunds computed equal the reserve used, and checks issued equal checks cleared plus checks outstanding plus checks reported.

The OCC asks for more than a reading of management's evidence on high-risk issues: “For higher-risk issues, internal audit should perform and document substantive testing to validate that the issue has been appropriately remediated.” For a customer remediation, substantive testing means re-performing refunds and tracing payments, not reviewing the project tracker. The same handbook adds that testing “should be conducted over an appropriate period of time and should confirm the sustainability, or operational effectiveness, of the remediation”, which for a fee error means checking that the fee has not come back since.

The team's workbook is the thing being tested. An audit that re-performs refunds from the workbook has tested the arithmetic of a spreadsheet, not the remediation.

How do you prove population completeness?

By rebuilding it independently from source and reconciling account by account, and by tying the starting set to a control total from outside the program. A full rebuild sounds expensive; it is cheaper than a second program. The auditor needs the scope definition, read access to every system that held history during the lookback, including archives from before a core conversion, and the fee schedule in force on each date. The rebuild should not reuse the team's query.

Internal audit can also be used earlier. In the foreclosure review, the GAO found that “several servicers engaged their internal audit department, which are separate from the servicers’ mortgage servicing operations, to conduct a preliminary validation of the results to identify problems or weaknesses with categorization activities” (GAO-14-376). A preliminary look at the population, before payment, is the cheapest audit work in the whole program.

How do you test remediation calculations?

Re-perform them from the raw postings and the approved method version, fee by fee, and compare to the cent. The tolerance should be zero: a remediation calculation is deterministic, so any difference is an error in the data, the method or its application. Test the method itself too: is the interest formula the one approved, are reversals netted, is the end date of interest the payment date.

A worked example from the fictional sample program shows the level of detail an auditor should expect. The approved method pays interest on each fee as the fee times 4.10% times the days from posting to payment, divided by 365, rounded to the cent. A $5.00 fee posted on March 4, 2025 and paid on November 16, 2026 earns 622 days of interest: $5.00 × 0.041 × 622 ÷ 365 = $0.349, or $0.35. The customer's fourteen fees come to $70.00 and $4.17 of interest, $74.17 in all, and every line is open to re-performance.

A refund the auditor can re-perform: every fee, its days and its interest

What evidence proves a refund was paid?

For a credit, the posting to the customer's account; for a check, the cleared item with its endorsement; for a returned check, the return, the address search and the reissue; for an unpaid amount, the state report and its general ledger entry. A check file sent to the vendor proves nothing about payment, and neither does a mailing.

Examiners look at the back of the check. The FDIC's examination procedure for verifying restitution directs examiners to “Verify that restitutions were made to all entitled customers and dispersed correctly”, and to review “Canceled restitution checks (When reviewing canceled checks be sure to look at the endorsement(s) on the back of the checks to ensure the checks have been endorsed by the appropriate individual(s))”, and to verify a sample of the endorsement signatures (FDIC Consumer Compliance Examination Manual II-10). An endorsement by someone other than the payee, on a check to a deceased customer for instance, is a delivery failure even though the check cleared.

Regulators running their own redress programs do the same. When the CFPB uses a contractor to pay victims, its team “also performs two postpayment reconciliations to ensure that eligible victims receive accurate payments”, and the inspector general tested that process across five cases (CFPB OIG, 2024).

What is a remediation file, and what must it hold?

The remediation file is everything an auditor or examiner needs to reach the program's numbers again without asking the team: the issue, the decisions, the data, the method, the payments and their outcomes. The test of a good file is whether someone who never worked on the program can re-perform any account from it.

When is a remediation closed?

When internal audit has validated it and every dollar has a final state, not when the last payment file is released. The OCC wants the difference visible: “audit issue status reporting should make a distinction between an issue considered closed by bank management and one closed by internal audit.” A remediation reported as complete while checks are still outstanding is complete only in the management column.

Under an order, closing also has a form. The CFPB's 2022 Regions order required compliance reports at 90 days and at one year, “approved by the Board, sworn to under penalty of perjury” (CFPB Consent Order 2022-CFPB-0008; terminated July 21, 2025). A board that signs a sworn statement about redress will want internal audit's validation in front of it first.

What do examiners ask for in a remediation?

The file, the population logic and proof of payment, and they test the bank's audit as well as the remediation. The FDIC's restitution procedure tells examiners to “Determine that a complete file search was conducted”, review the calculations and the cancelled checks, and compare the bank's list of exceptions with its findings. The OCC's compliance examination procedures direct examiners to “Verify that the audit function follows up on and validates the adequacy of management’s corrective actions to noted findings” (Comptroller's Handbook, Compliance Management Systems).

In practice examiners re-perform a handful of accounts themselves, chosen where errors are likeliest: closed accounts, deceased owners, the earliest months of the lookback, the smallest refunds. An audit that has already tested those strata answers the examiner's sample before it is drawn.

Internal audit's view in Customer Remediation

In Botminds' Customer Remediation, the Validation agent works for internal audit and is read-only: it never edits program data. On a closed sample program, NSF fees charged again on re-presented items, it re-performed a blind sample of 60 accounts in four strata, rebuilt the population on its own (28,906 accounts both times) and tied the payments to the general ledger. Only the internal audit validation lead signs, and the completion report waits for her.

Close-out in Customer Remediation, validated from the evidence, not the summary

Every action behind those numbers, by people and agents, sits on one audit trail with who, what, when, why and the evidence, and exports to an examiner pack with account numbers masked. What happens to the checks that are never cashed is the part of delivery that runs longest.

The audit trail an examiner can follow

Questions people ask

What is the difference between remediation testing and remediation validation?

The words are used loosely, but a useful split is this: testing is the work, re-performing refunds and tracing payments; validation is the conclusion, an independent sign-off that the remediation can be relied on and the issue closed. Audit validates by testing. A validation without testing is an opinion about the team's own report.

How long after payment should internal audit test a remediation?

Long enough for checks to clear or come back, and soon enough to fix what it finds. Orders have set windows such as 90 days after reimbursement ends or 180 days after the plan is completed. Testing calculation can start as soon as the method is approved; delivery testing needs the first months of check activity.

Can audit rely on the remediation team's reconciliations?

It can use them as a map, not as evidence. The team's reconciliations show where to look; audit's own rebuild and re-performance from source are what support its sign-off. Where the team used an independent second build, audit can test that the builds were in fact independent and then rely on the reconciliation more.

What if a remediation check was cashed by the wrong person?

The customer has not been paid, whatever the bank's books say. The payment is investigated like any misdirected check, the customer is paid, and audit widens its endorsement testing in that stratum, starting with deceased owners and joint accounts.

Does internal audit have to test every account?

Not for calculation and delivery, where a stratified sample re-performed from source is the norm. Completeness is different: an independent rebuild of the whole population is the only test that can find a customer the program left out, and the totals must tie in full.