Regulatory reporting controls that put tested, cited evidence behind every signature on the Call Report
The CFO attests on evidence the agents collected and tested, not on emails.
See one case, screen by screen ↓Regulatory Reporting Controls is software for banks that puts tested evidence behind the CFO's quarterly Call Report attestation. Seven agents capture control evidence as each control runs, challenge it for separation-of-duties breaks and late evidence, re-perform key controls on samples and trace the top Call Report lines to their sources. Process owners sign their sub-certifications, the Controller decides and recommends, and the CFO attests when all of them are signed.
AI use cases in banking: a buyer's guide to agentic AI for bank and credit union operations →
Updated
Regulatory reporting controls are what stand behind one sentence: every quarter the Chief Financial Officer signs the officer declaration on the FFIEC Call Report, that it was prepared to the instructions and is true and correct. Behind that signature sit dozens of controls other people run: reconciliations, reviews, access reviews, change approvals, mapping checks. Today the sub-certification process is a template emailed to 20 to 30 process owners after quarter-end, a spreadsheet of who has signed, and control evidence requested weeks after the control ran.
The risk sits in what nobody checks before the CFO signs. Nobody re-performs the controls first. A preparer who reviewed their own reconciliation is found months later, if at all, by internal audit or the external auditor, and evidence dated after its sign-off is a finding on its own. Nobody can say, line by line, which controls stand behind a Call Report figure, and data quality in regulatory reporting draws enforcement in its own right.
Estimated split of the Controller's team's days in one quarterly sub-certification cycle, by hand and with the agents; our estimate, kept modest.
Seven agents capture, challenge, re-perform and trace; owners sign, the Controller decides, the CFO attests.
Tessaly Community Bank, a $3.4 billion community bank, files its Q3 2026 Call Report (FFIEC 041) by Friday, October 30. It is Thursday, October 22, day 22 of 30. Here is how its regulatory reporting controls reach the CFO's signature, screen by screen, in the working solution.
Renata's home screen is the CFO's attestation as one sentence. Below it she reviews 23 process owners in five areas: loans and credit; deposits, treasury and payments; ledger, tax and capital; reporting and allowance; technology and data. Behind them sit 61 key controls, 702 pieces of evidence, 350 sample items re-performed and 8 Call Report lines traced. One branch is blocked: Dana Ostrow, with a plain “Separation of duties” chip, and the screen offers one next step, open RR-07.
“22 of 23 sub-certifications ready.”
RR-07 is the monthly loan subledger to GL reconciliation, owner Dana Ostrow, reviewer Theo Brandt, backup reviewer not set. The July instance was prepared by Dana at 18:52 on Sunday, August 2 and reviewed by Dana at 19:06, on the same workstation. Theo was on leave and no backup was set. Dana replied that she would route it for re-review; it was never routed. August and September were reviewed by Theo.
The Skeptic never closes its own flag and never flags without a citation.
Each citation in the finding opens the passage it rests on. Here it is the general ledger sign-off log entry GLS-0802-0418: the July loan reconciliation, reviewed by D. Ostrow at 19:06:41 on August 2, status Reviewed. The Evidence agent captured it when the control ran, with its time and hash, and nobody can edit it.
“Captured by the Evidence agent with its time and hash. Read-only.”
The Tester re-foots the loan subledger at July 31, $2,481,659,357, and agrees the reconciling item to payment batch PB-0731-22: $246,857, in the subledger on July 31 and the ledger on August 3. The adjusted subledger, $2,481,906,214, matches the July 31 trial balance of GL accounts 1400–1490. Every line of the arithmetic cites its source.
“Ties · difference $0.00”
Renata assigns an independent reviewer with reason code IR-01, “Preparer reviewed own work”. The picker offers Theo Brandt, back from leave and read-only in the loan subledger, and Andre Whitaker, the Assistant Controller. Dana Ostrow cannot be chosen because she prepared the instance, and neither can Victor Almeida, who has posting rights in the loan subledger.
Dana opens RR-07 and tries to re-review the July reconciliation herself. The system refuses, names the rule and names the person who must do it. Separation of duties in accounting is enforced here, not left to a policy document.
“A preparer cannot review her own work. You prepared the July reconciliation of RR-07. The re-review must be done by Theo Brandt.” Rule SOD-1
Theo re-reviews with the tie-out in front of him and signs. The Skeptic re-checks his independence: he is not the preparer and has read-only access to the loan subledger. The Deficiency agent then proposes DEF-Q3-03 as a control deficiency, not significant, because the balance ties and the variance review RR-03 operated.
“Independent review signed by Theo Brandt.”
The proposal shows its reasoning: likelihood, one instance of three this quarter; magnitude, re-performance ties with a difference of $0.00; compensating control, RR-03 operated. Renata accepts it as a control deficiency, with backup reviewer Andre Whitaker set for RR-07. Four deficiencies this year, none significant and no material weakness. Dana signs her sub-certification and the tree reads 23 of 23.
Anything above a control deficiency goes to the Audit Committee.
Loans and leases held for investment, Schedule RC item 4.b, is $2,512,384,906 at September 30. The Lineage agent traces it from the core banking system (18,412 loan accounts) to the loan subledger, GL accounts 1400–1490, the regulatory reporting system's mapping rule and the Call Report line, with a key control on every hop: RR-05, RR-07, RR-01, RR-04 and RR-03. All 8 top lines are covered; in June it found the brokered-deposit hop on RC-E that no control covered, and RR-26 was added.
The Lineage agent never changes a mapping; it flags a gap and never fills it.
Everything that stands behind the officer declaration is listed and open, 7 of 7 clear: 23 of 23 sub-certifications, 61 of 61 key controls evidenced, 349 of 350 items re-performed, 8 of 8 lines traced, no open separation-of-duties breaks, every deficiency decided. Renata recommended; Graham attests. Three directors attest at the October 27 board meeting, and the report is filed from the regulatory reporting system by October 30.
The Controller who recommends can never attest, and the CFO cannot recommend. Rule SOD-6
The same quarter, seen by the four people who carry the attestation: what it looked like, and what it looks like now.
Seven agents capture, challenge, re-perform and trace; owners sign, the Controller decides, the CFO attests.
Captures evidence the moment each control instance completes: GL sign-offs and reconciliations, change tickets, access reviews, checklists and committee minutes. Records when and by whom each piece was produced, and hashes it.
Challenges every piece of evidence: a preparer who reviewed their own work, evidence dated after its sign-off, a reviewer without independence or with posting rights. Holds the sub-certification until a person decides.
Re-performs 14 key controls on 25-item samples, and every flagged instance in full: re-foots, re-ties and re-checks independence, showing the arithmetic and marking each item pass or exception.
Traces the top Call Report lines from the source systems through the mapping rules and the GL to the line, and names the key control that guards every hop.
Proposes a classification (control deficiency, significant deficiency or material weakness) with its likelihood, magnitude and compensating-control reasoning, using the bank's severity guide.
Sends the sub-certification requests on day 6, reminders 7 and 2 days before the due date, and escalations to the Controller on day 21 and to the CFO on day 24.
Assembles the attestation memo and the evidence packs for the external auditor, examiners, the Audit Committee and internal audit, every statement cited to its evidence.
Sign · decide and recommend · attest. The agents propose; a named person decides.
Ask the agents in plain words about a control, a person, a piece of evidence or a line. Every answer cites its source, and some open the screen for you.
Why is Dana Ostrow's sub-certification blocked?
Because one of her four controls has an open flag. RR-07, the monthly loan subledger to GL reconciliation, was prepared and reviewed by Dana Ostrow for July: prepared at 18:52 and reviewed at 19:06 on Sunday, August 2. Her reviewer, Theo Brandt, was on leave and no backup was set. August and September were reviewed by Theo. Next step: assign an independent reviewer.
Which controls stand behind the loans line on the Call Report?
Schedule RC item 4.b, $2,512,384,906, passes through five hops. Each has a key control: RR-05 core to subledger, RR-07 subledger to GL, RR-01 GL to the report, RR-04 the mapping rule LN-RC4B, and RR-03 the second-preparer variance review. RR-07 is the only one with an open flag.
What has changed since last quarter's attestation?
Three things. One new deficiency is waiting for you: DEF-Q3-03 on RR-07. Two were decided this quarter, on RR-44 and RR-33. And the FDIC's Part 363 thresholds moved on January 1: the internal control assessment now applies from $5 billion, so Tessaly keeps it under board policy.
Prepare the evidence pack for the external auditor
Started the external auditor pack for Q3 2026: 23 sub-certifications, 61 controls with 702 pieces of evidence, the Tester's 350 sample items, 8 lineage traces and 4 deficiencies, with every sign-off and reason from the audit trail. Customer account numbers are masked, and no BSA records are included. It is waiting for your release.
13 screens from the working solution, on its sample data. Pick one to see it large.
The calendar, sample sizes, thresholds and data rules are settings. Every change waits for a second administrator and is on the change history.
| Setting | Default | Choose from |
|---|---|---|
| Sub-certification requests go out | Day 6 after quarter-end | Reminders 7 and 2 days before due, by email and chat |
| Sub-certifications due | Day 20 | Escalate to the Controller on day 21 and to the CFO on day 24 |
| CFO attests by | Day 29 | The Call Report is due on day 30 |
| Sample size | 25 items for daily and per-transaction controls | Every instance for monthly and quarterly controls |
| Agent confidence thresholds | Skeptic 0.80 · Lineage agent 0.90 · Deficiency agent 0.85 | Below the threshold a finding shows as “possible”, never a flag |
| Customer numbers | Masked to the last 4 digits | The Controller and internal audit can unmask for 5 minutes, logged |
| Keep evidence and sign-offs | 7 years, bank policy | Any BSA record kept at least 5 years; BSA and SAR records never sampled or exported |
| Examiner and auditor access | Read-only, released packs only | Expires after 14 days |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample data · “target” = the design goal, measured in the live solution · “estimated” = our estimate · “typical” = published figures and rules: FDIC FIL-44-2013, Call Reports due within 30 calendar days of the report date; FFIEC 041 cover page, the officer declaration and the directors' attestation; FDIC Quarterly Banking Profile, second quarter 2025, 4,421 FDIC-insured institutions; Federal Reserve and OCC enforcement actions of July 10, 2024, $135.6 million in penalties against one large bank, in part over data quality in regulatory reporting; 12 CFR 363 guidance and the FDIC's thresholds from January 1, 2026. Tessaly Community Bank, the people, controls and balances named on this page are fictional: characters and sample data in the working solution.
Regulatory Reporting Controls is software for banks that puts tested evidence behind the CFO's quarterly Call Report attestation. Seven agents capture control evidence as each control runs, challenge it for separation-of-duties breaks and late evidence, re-perform key controls on samples and trace the top Call Report lines to their sources. Process owners sign their sub-certifications, the Controller decides and recommends, and the CFO attests when all of them are signed.
The Certification coordinator sends each process owner a request on day 6 after quarter-end, reminds them 7 and 2 days before the day-20 due date, and escalates to the Controller on day 21 and to the CFO on day 24. An owner can sign only when their controls have no open flags. The Controller can revoke a signature with a reason when its evidence changes.
The Skeptic compares the preparer and reviewer of every control instance in the sign-off log, checks reviewers for independence and posting rights, and flags evidence dated after its sign-off. Each flag cites the log entry and holds the sub-certification until a person decides. The system itself refuses a preparer who tries to review the same instance.
It tests them. The Tester re-performs 14 key controls on 25-item samples and every flagged instance in full, showing the arithmetic with its sources and marking each item pass or exception. In the sample quarter, 349 of 350 items pass and the one exception is decided by the Controller with a reason code. Internal audit tests on its own and records its own results.
Yes, for the top Call Report lines. The Lineage agent traces each one from the core banking system through the subledger, the general ledger and the mapping rule to the line, and names the key control on every hop. A hop with no control is flagged for a person to close; the agent never changes a mapping.
Yes. Agents never sign, never close their own flags and never decide a deficiency. Owners sign their sub-certifications, an independent reviewer re-reviews, the Controller decides deficiencies and recommends, and the CFO attests; anything above a control deficiency goes to the Audit Committee. Every override needs a reason code.
One audit trail of every action by people and agents, with who, what, when, the reason and the evidence, and packs built for the external auditor, FDIC examiners, the Audit Committee and internal audit. Packs are watermarked, mask customer numbers, exclude BSA and SAR records, and are released by the Controller; examiner access is read-only and expires after 14 days.
The Agentic Solution Engine builds and deploys it from your requirements and documents, such as your control library, sub-certification templates and a past quarter's sign-offs, and it goes live once every quality gate has passed. We will walk you through it on your own controls first.
Every COREP and FINREP cell traced to its source, and each new release mapped in days.
1-min demoBCBS 239 ComplianceEach board figure traced to source, reconciled at every hop, every rating cited.
1-min demoCall Report Instructions SearchA cited answer in under a minute, with the bank’s own precedent beside the instruction.
1-min demoWe'll run Regulatory Reporting Controls on your own control library and a past quarter's sign-offs.