Control evidence that holds up for examiners and auditors

Control evidence is the documentation that shows a control actually operated: who performed it, when, on which data, with what result, and who reviewed it. For the controls behind a bank's Call Report, that means reconciliations with their sign-off log entries, approved journal entries, mapping change tickets, access reviews and variance reviews. Evidence holds up for examiners and auditors when it was produced by the control as it ran, can be tied to a named and independent person, and cannot have been changed since. It is hard to get right because it lives in five or six systems and is usually gathered weeks after the quarter closes, when nobody can say for certain what happened. Botminds' Regulatory Reporting Controls captures each piece as the control completes, with its time and a hash.

What is control evidence?

Control evidence is whatever lets a second person confirm, after the fact, that a control ran as designed. GAO's standards describe good documentation as "establishing and communicating the who, what, when, where, and why of internal control execution", and note that it lets an organization "communicate that knowledge as needed to external parties, such as external auditors" (GAO Green Book, para. 3.10). For a Call Report, the OCC sets the purpose more narrowly: work papers should tie the reported data to the bank's financial records, meet the bank's documentation standards and leave an audit trail an examiner can follow (OCC Comptroller's Handbook, "Regulatory Reporting," Work Papers).

Those are two different things, and a bank needs both. A work paper ties a number on Schedule RC to the general ledger. Control evidence shows that the tie-out was reviewed by someone who did not prepare it, before the CFO signed. A perfect work paper with the preparer's name in both boxes proves the arithmetic and nothing about the control.

What makes control evidence sufficient?

Evidence is sufficient when an independent reader could reach the same conclusion from it without asking anyone. That rules out most of what a quarter-end evidence request produces: a reconciliation exported to PDF last week, an email saying "reviewed, all fine", a screenshot of a report with no date on it. Each may be true. None of them shows when the review happened or who did it.

The strongest evidence is produced by the system as a side effect of doing the work: the general ledger's sign-off log entry, written when the reviewer clicked "reviewed"; the ticket system's approval, stamped when the approver approved; the access tool's certification, dated when it was certified. That evidence was not created to satisfy an auditor, which is what makes it persuasive to one. The last question of the OCC's internal control questionnaire asks the same thing of work papers: whether they give a clear trail from the reported data back to the financial records, and whether they are ready to hand when an examiner asks.

Every statement opens to the source it rests on

Six pieces of evidence sit behind this one monthly control for the quarter, each captured when it was produced.

What is evidence dated after sign-off?

It is evidence whose own timestamp is later than the sign-off it is meant to support. A reconciliation file created on October 15 for a review signed on August 2, or a journal entry approved the morning after it was posted, is evidence that something happened, but not that the control happened when the sign-off says. A reviewer cannot have reviewed on August 2 a document that did not exist until October.

Auditors read late evidence as reconstruction, and reconstruction raises the question of what else was rebuilt. The honest cases are common: an owner who did the review on screen and saved the file later. The answer is to make capture automatic at the moment of the sign-off, so the question never arises. In the sample bank used throughout this series, Tessaly Community Bank (fictional, with fictional people and figures), one of 25 sampled manual journal entries over $250,000 was approved the next morning: $1,240,000, posted one day, approved by an independent person within 17 hours. It was classified as a timing exception, not a failure of the entry, and the bank moved to approval before posting for entries over $1 million.

Captured as the control runs, or reconstructed at quarter end

The difference is not the quality of the people collecting the evidence; it is when they collect it. Evidence pulled together in the last week of the filing window depends on memory, on files that may have been overwritten, and on owners who are also busy closing the quarter. Evidence captured when the control completes depends on nothing but the system that ran the control.

The public cost of weak data controls is large. In July 2024 the Federal Reserve fined Citigroup $60.6 million for insufficient progress on data quality management under its 2020 enforcement action, and the OCC assessed a $75 million civil money penalty against Citibank, citing among other things the absence of processes to monitor how data quality problems affected regulatory reporting; the two penalties came to about $135.6 million (Federal Reserve, July 10, 2024; OCC order AA-ENF-2024-51). The lesson for a community bank is narrower but real: an examiner who asks how management knows its controls work wants evidence, not assurance.

What evidence do examiners ask for?

Examiners ask first for what the bank already produced, then test a sample against it. The OCC's scoping steps start from internal and external audit reports and work papers, previous examination findings, quality control and quality assurance reports, board packages and minutes, and the bank's own risk assessments. When they test, they select a sample of schedules, read the work papers behind each sampled line item against the Call Report instructions, and, where a bank uses an automated system, check a sample of the account codes that map the general ledger to the report (OCC examination procedures, quantity of risk). Evidence that cannot be produced for a sampled line is a finding before the line is even tested.

The last column is the one most evidence matrices leave blank. A matrix that names the evidence but not the moment it is captured invites the quarter-end request this page argues against. Filled in, it doubles as the specification for automation: each row is one place to read from and one event to read it at. The examiner's own sampling logic, and how to build an internal audit program around it, is the subject of a call report audit program built from the examiners' own steps.

Evidence created to satisfy an auditor persuades fewer auditors than evidence the control produced on its own.

How long should control evidence be kept?

At least as long as the report it supports must be kept, and in practice as long as the longest reader may ask. The General Instructions tell a bank to keep its signed Call Report with the workpapers and supporting documentation for three years after the report date, longer if state law requires. Part 363 sets two longer horizons for institutions it covers.

Because the accountant's working papers often contain the bank's own evidence, many banks keep the evidence behind key controls for the same seven years. The sample bank does, by policy. The period matters less than the form: seven years of evidence in shared drives is seven years of files that can be moved, renamed or overwritten.

Control evidence handling: who may see it, and in what form

Evidence handling is the set of rules for storing, masking and releasing evidence, and it matters because control evidence is full of customer data. A loan reconciliation sample lists loan numbers; a deposit reconciliation lists accounts. The packs that go to the external auditor, examiners, the audit committee and internal audit each need a different cut, and none of them needs every customer number in clear.

One audit trail, and a pack for the examiners that waits for the Controller's release

How Regulatory Reporting Controls captures control evidence

An Evidence agent captures each piece the moment the control instance completes: general ledger sign-offs and reconciliations, change tickets, access reviews, checklists and committee minutes. It records when and by whom each piece was produced and hashes it. It never accepts evidence it cannot timestamp and never edits a source file. In the sample quarter that was 702 pieces from six systems behind 61 key controls.

The Skeptic then reads the evidence the way an auditor would: preparer against reviewer, evidence time against sign-off time, reviewer entitlements against the system reviewed. Each flag cites the piece it rests on, which is how the July self-review in the sample bank was found one minute after it happened, and why the separation of duties check needs captured evidence to work at all. Packs for examiners and auditors are assembled from the same captured evidence, every statement cited, and released only by the Controller.

What the solution does not do is decide what evidence a control needs. That is the bank's control design, written down in its control library, and the agents capture what the library says each control produces. A control with no defined evidence is a gap the solution shows; it is not one it fills.

Questions people ask

Is a screenshot good control evidence?

Only if it shows the date, the user and the population, and only if nobody could have taken it later. Most do not. A system log entry or an exported report with the system's own timestamp is stronger, because it is produced by the control rather than about it.

What is the difference between control evidence and a work paper?

A work paper supports a number: it ties a Call Report line to the general ledger. Control evidence supports a process: it shows that the tie-out was reviewed, by whom and when. The OCC expects work papers to give a clear audit trail; auditors testing a control expect both.

Who owns control evidence?

The control owner is responsible for the control producing it; the system of record holds it. A central team or a tool can collect and keep it, but responsibility for a Call Report stays with the bank, and the instructions say it cannot be handed to a software vendor or servicer.

Can the external auditor rely on evidence internal audit gathered?

Part 363 allows it: the FDIC's guidelines say nothing in the rule is "intended to preclude the ability of the independent public accountant to rely on the work of an institution's internal auditor." How far an auditor relies depends on the internal auditor's independence and the quality of the work.

What is a control evidence matrix?

A table that lists, for each key control, the evidence it produces, the system that holds it and the moment it is produced. It is the specification for both manual evidence requests and automated capture, and the column for the moment of capture is the one that decides whether evidence will hold up.