Banks in the United States are audited by several different parties at once, and each one looks at something different. Internal audit staff review daily operations for the board. Independent CPA firms verify the annual financial statements. Three federal agencies — the Office of the Comptroller of the Currency, the Federal Reserve, and the Federal Deposit Insurance Corporation — examine safety and soundness, with which agency depending on how the bank is chartered. The Consumer Financial Protection Bureau checks how the bank treats customers. Separate specialists audit anti-money-laundering programs and IT security. And state banking departments oversee any bank operating under a state charter. No single reviewer sees everything, which is the point.
Internal Audit Staff
The first layer sits inside the bank. Internal auditors are bank employees, but they report to the board of directors or an audit committee rather than to management. That reporting line is what gives the function its independence: the people running daily operations can’t tell the audit team what to find.
Internal auditors test whether the bank’s own policies and controls work in practice. They review transactions for errors or fraud, check that staff follow procedures, and flag weaknesses in accounting or security before those problems get expensive. When outside auditors or federal examiners arrive, one of the first things they evaluate is the quality of the internal audit program. A strong internal function reduces outside scrutiny; a weak one guarantees more of it.
Independent CPA Firms
Beyond internal monitoring, banks hire outside accounting firms to verify their financial statements. These auditors focus on whether the numbers the bank reports to shareholders and regulators are accurate and prepared under generally accepted accounting principles.
Any insured bank or savings association with consolidated total assets of $1 billion or more must have its annual financial statements audited by an independent public accountant. At $5 billion in assets, management must also formally assess the effectiveness of internal controls over financial reporting, and the outside auditor must independently verify that assessment.1eCFR. Part 363 – Annual Independent Audits and Reporting Requirements Smaller community banks below $1 billion are not required to hire a CPA firm for a full financial statement audit, though federal and state examiners still review them.
For publicly traded banks, the Sarbanes-Oxley Act adds personal accountability on top of the audit itself. The CEO and CFO must sign every annual and quarterly report, certifying that the financial statements fairly represent the bank’s condition and that they’ve evaluated internal controls within the prior 90 days.2Office of the Law Revision Counsel. 15 USC 7241 – Corporate Responsibility for Financial Reports An officer who willfully signs a false certification faces criminal fines up to $5,000,000 and up to 20 years in prison.3Office of the Law Revision Counsel. 18 USC 1350 – Failure of Corporate Officers to Certify Financial Reports
If the outside auditors find material misstatements or serious control weaknesses, they can issue a qualified opinion. For a publicly traded bank, that carries consequences beyond any fine — stock price drops and heightened regulatory attention typically follow.
Federal Bank Examiners
Government examiners run their own independent reviews of safety and soundness. Which agency shows up depends on how the bank is chartered.
Office of the Comptroller of the Currency
The OCC supervises all nationally chartered banks and federal savings associations. Under federal law, the Comptroller appoints examiners who review each national bank as often as deemed necessary.4Office of the Law Revision Counsel. 12 USC 481 – Appointment of Examiners; Examination of Member Banks, State Banks, and Trust Companies; Reports In practice, the OCC conducts a full-scope, on-site examination of every institution it oversees at least once every 12 months.5eCFR. 12 CFR Part 4 Subpart A – Organization and Functions Examiners assess whether the bank operates safely, treats customers fairly, and provides equitable access to financial services.
Federal Reserve Board
State-chartered banks that join the Federal Reserve System are examined by Federal Reserve examiners. Submitting to examinations directed by the Board of Governors is a condition of membership.6Federal Reserve. Federal Reserve Act Section 9 – State Banks as Members Federal Reserve exams focus heavily on risk management, capital adequacy, and the institution’s ability to withstand economic downturns.7Board of Governors of the Federal Reserve System. State Member Banks Supervised by the Federal Reserve
Federal Deposit Insurance Corporation
State-chartered banks that are not Federal Reserve members fall under FDIC supervision as their primary federal regulator. The FDIC must conduct a full-scope, on-site examination of each insured institution at least once every 12 months.8Office of the Law Revision Counsel. 12 USC 1820 – Administration of Corporation That cycle can stretch to 18 months for well-capitalized banks with less than $3 billion in total assets, a CAMELS composite rating of 1 or 2, no pending enforcement actions, and no recent change in control.9Federal Deposit Insurance Corporation. Section 1.1 Basic Examination Concepts and Guidelines The same 18-month extension is available to the OCC and Federal Reserve under parallel provisions.
The CAMELS Rating
Whichever federal agency conducts the exam, examiners score the bank using the CAMELS framework. The acronym stands for Capital adequacy, Asset quality, Management, Earnings, Liquidity, and Sensitivity to market risk. Each component and an overall composite receive a rating from 1 (strongest) to 5 (weakest).10Federal Reserve. Supervisory Letter SR 96-38 (SUP) on Uniform Financial Institutions Rating System A composite 5 signals a bank the Federal Reserve considers likely to fail without outside help. Poor ratings can trigger formal enforcement actions such as cease-and-desist orders or civil money penalties.
Why You Can’t Read the Exam Report
Federal examination reports are not available through a public records request. They are shielded from disclosure under FOIA Exemption 8, which courts have read broadly. The reasoning is that releasing candid regulatory assessments could trigger bank runs, so Congress wanted examiners to be blunt without worrying their findings would cause the panic they’re trying to prevent.11Department of Justice. Exemption 8 One narrow exception exists: FDIC reports on material losses to the deposit insurance fund must be disclosed on request, with customer-identifying information removed.
Consumer Financial Protection Bureau
The CFPB adds a separate examination track focused on how banks treat consumers. The Bureau has direct supervisory authority over banks with more than $10 billion in total assets. For smaller banks, the primary federal regulator handles consumer compliance examinations, but the CFPB writes the rules everyone follows.
CFPB examiners review compliance with more than a dozen federal consumer financial laws, including the Truth in Lending Act, the Equal Credit Opportunity Act, the Fair Credit Reporting Act, the Real Estate Settlement Procedures Act, and prohibitions on unfair, deceptive, or abusive practices.12Consumer Financial Protection Bureau. Supervision and Examinations These are not solvency exams. A bank can be profitable and well-capitalized while still violating consumer protection laws through deceptive fee disclosures or discriminatory lending patterns.
BSA and Anti-Money-Laundering Testing
Every bank in the United States must maintain a Bank Secrecy Act compliance program, and independent testing of that program is required by regulation. The OCC, Federal Reserve, FDIC, and NCUA each have their own regulatory provision mandating it.13FFIEC BSA/AML InfoBase. Assessing the BSA/AML Compliance Program – BSA/AML Independent Testing The tester (internal audit staff or an outside firm) evaluates whether the bank is identifying and reporting suspicious transactions, filing currency transaction reports, and screening customers against sanctions lists.
No regulation specifies how often BSA testing must occur. Regulators expect the frequency to match the bank’s risk profile: a community bank with a simple customer base might test every 18 months, while a large institution handling international wire transfers and correspondent banking should test more often. When examiners find errors, they expect the bank to increase testing frequency to verify that fixes worked.13FFIEC BSA/AML InfoBase. Assessing the BSA/AML Compliance Program – BSA/AML Independent Testing
IT and Cybersecurity Examinations
Bank examiners also evaluate the technology infrastructure the bank runs on. The Federal Financial Institutions Examination Council publishes detailed IT examination guidance covering information security, business continuity, outsourced technology services, and payment systems.14FFIEC IT Examination Handbook InfoBase. FFIEC IT Examination Handbook InfoBase – Home
During IT exams, regulators assess whether the bank has adequate access controls, encrypts sensitive customer data, tests systems for vulnerabilities, and maintains workable disaster recovery plans. The Gramm-Leach-Bliley Act’s Safeguards Rule requires a written information security program with regular risk assessments, employee training, oversight of third-party service providers, and an incident response plan. The bank must also designate a qualified individual responsible for the overall security program.
State Banking Departments
Any bank operating under a state charter also answers to its state banking department or commission. The state agency granted the charter and can revoke it. State examiners focus on compliance with local lending limits, consumer protection laws, and licensing conditions that may differ from federal standards.
State and federal regulators often coordinate their schedules to avoid stacking exams on top of one another. Federal law explicitly allows alternating cycles: the state conducts the exam one period and the federal agency handles the next, as long as the state exam meets federal standards.8Office of the Law Revision Counsel. 12 USC 1820 – Administration of Corporation The result is a near-constant regulatory presence at every insured bank, without any single reviewer duplicating what another has already done.