Readiness runs before the letter arrives
A recurring schedule starts the readiness review every quarter and assigns it to the coordinator. Open findings, stale procedures and evidence gaps show up months before an examiner asks.
Regulatory Examination Preparation Checklist Template
Most bad examinations go wrong before the examiners arrive: a request list worked from a spreadsheet, documents sent without a second read, and last cycle’s findings still open.
This free checklist is for compliance officers and exam coordinators at banks, broker-dealers, investment advisers and UK-regulated firms. A readiness review runs on a schedule whether or not an exam is due. When a notice or request list arrives, conditional phases switch on for triage, production, fieldwork and the exit meeting. If the regulator issues findings, MRAs or a deficiency letter, two more phases run the management response and track each action to validated closure. Every request has an owner, every production is approved before release, and the response is signed off by a named senior approver.
Readiness, the Live Exam and Remediation: Three Different Jobs
An examination is not one task. Readiness is standing work: prior findings closed, procedures current, evidence easy to find. The live exam is a project with hard deadlines, run from a request list. Remediation can outlast the exam by a year. Firms that leave all three until the notice arrives spend the first week of fieldwork finding documents instead of explaining their controls.
The bar for a formal banking finding also moved in 2026. An OCC and FDIC final rule, effective 2 November 2026, limits matters requiring attention (MRAs) to practices that could reasonably be expected to materially harm a bank’s financial condition, or to actual violations of banking law. Weaker points become informal supervisory observations. The FDIC dropped Matters Requiring Board Attention from exam reports issued after 31 August 2026. The Federal Reserve did not join the rule, but has narrowed its own MRAs and MRIAs through staff operating principles, last revised on 24 September 2026. Fewer points may reach the bar, and those that do will carry more weight.
Standing readiness
Owned by compliance or the exam coordinator
Cadence: quarterly, and before any expected exam window.
Output: closed findings and an indexed evidence library.
Live examination
Run by the coordinator with named approvers
Cadence: from the notice to the exit meeting.
Output: a production log, meeting notes and an issues list.
Findings & remediation
Owned by accountable executives
Cadence: from written findings to closure.
Output: an approved response and validated closure.
What the Regulatory Exam Preparation Checklist Covers
Phase 1 runs every time. Phases 2 to 5 switch on when an examination is notified, and Phases 6 and 7 switch on when findings are issued.
Phase 1
Phase 1: Standing Readiness Review
Runs on a schedule whether or not a notice has arrived. Owned by the compliance officer or exam coordinator.
- Record the regulator and whether an examination has been notified — a “Yes” switches on Phases 2 to 5
- Name the exam coordinator and the approvers — one contact for examiners, a production approver and a response approver
- Confirm every open finding from the last exam is closed or on track — with closure evidence attached
- Check policies and procedures are current and followed in practice — review dates, approvals and a sample of practice
- Refresh the standing evidence library — minutes, risk assessments, audit reports and MI, indexed
- Run a mock exam on the highest-risk areas — sample testing and practice interviews
- Log self-identified issues and start remediation now — the Fed and OCC give credit for issues a firm finds and fixes itself
Phase 2
Phase 2: Notice & Request List Triage
Shown only when an examination has been notified. Owned by the exam coordinator.
- Log the notification and the key dates — first production due, fieldwork start, examiner in charge
- Split the request list into numbered items with an owner and due date for each — one row per request, tracked to production
- Agree logistics and the status meeting cadence with the examiners — transfer channel, workspace, one point of contact
- Tell in-scope staff the exam is coming and how to handle examiner contact — all requests go through the coordinator
Phase 3
Phase 3: Document Collection & Production QA
Shown only when an examination has been notified. Nothing is sent until the production approver signs it off.
- Review each production for completeness and accuracy — does it answer the question, and is it current and consistent?
- Screen for privileged material and third-party confidential data — log anything withheld or redacted, with the reason
- Mark confidential supervisory information and restrict who can see it — in the US, exam reports remain the agency’s property
- Add a FOIA confidential treatment request to SEC productions where appropriate — under 17 CFR 200.83; shown only for SEC exams
- Number every page and record the production in the production log — page range, request item, date and channel
- Approve the production before release — “Returned” sends it back to the owner with comments
Phase 4
Phase 4: Entrance Meeting & Fieldwork
Shown only when an examination has been notified.
- Prepare the entrance meeting presentation — business overview, changes since the last exam, prior findings
- Prepare interviewees — answer the question asked, do not guess
- Assign a note-taker to every examiner meeting — written notes only: SEC staff do not record meetings and ask firms not to
- Hold the status meeting and update the request tracker — open items, supplemental requests and new questions
- Log each issue raised by examiners on the day it is raised — with an owner and a fix date
Phase 5
Phase 5: Exit Meeting & Written Findings
Shown only when an examination has been notified. The written report can follow weeks or months later.
- Prepare for the exit meeting — preliminary issues, disputed facts, missing evidence
- Record each preliminary finding as the examiners state it at the exit meeting — exact wording matters later
- Correct factual errors in writing with evidence — before the written report is finalised
- Log the written report and record whether findings were issued — a “Yes” switches on Phases 6 and 7
- Brief senior management and the board on the outcome — including findings needing board oversight
Phase 6 — If Findings
Phase 6: Management Response & Remediation Plan
Shown only when findings were issued. Approved by the response approver named in Phase 1.
- Assign each finding an accountable owner and a root cause — fix the cause, not only the sampled instance
- Build the remediation plan — actions, milestones and the evidence that will prove completion
- Draft the written response by the regulator deadline — for example, generally 30 days from the date of an SEC deficiency letter
- Senior management or board approval of the response — recorded as Approved or Returned
- Submit the response and file the confirmation — with the date sent and the channel used
Phase 7 — If Findings
Phase 7: Remediation Tracking & Closure
Shown only when findings were issued. Stays open until the regulator closes the last item.
- Track each action against its milestones and report status to the board or committee — monthly until closure
- Tell the regulator early if a remediation date will slip — with the reason and a revised date
- Have internal audit validate completed remediation — the Federal Reserve relies on satisfactory internal audit validation
- Send closure evidence and record the outcome for each finding — closed, pending validation or a FINRA disposition
- Feed lessons learned into the next readiness review — update the evidence library and mock exam scope
The Exam Lifecycle by Regulator
Banking agencies, securities regulators and UK supervisors use different words for the same stages. The table maps each stage to each regulator’s process and to the checklist phase that handles it. Practice varies with charter, size and supervisory team, so treat the table as a starting point, not legal advice.
| Stage | US banking agencies | SEC / FINRA | UK FCA / PRA | Phase |
|---|---|---|---|---|
| Notice & requests | OCC request letter or Federal Reserve first day letter listing items to send before and at the start | SEC: a call to the CCO, then a letter and request list by secure email. FINRA: Request Manager in FINRA Gateway, backed by Rule 8210 | Information requests, including formal notices under FSMA s165 | Phases 2–3 |
| Producing documents | Exam reports and supervisory letters are confidential supervisory information: 12 CFR 4.36 (OCC), 261.20 (Fed), 309.6 (FDIC) | SEC expects records within 24 hours in most cases but usually allows longer; FOIA confidential treatment under 17 CFR 200.83 | Deal with the regulator openly and co-operatively: FCA Principle 11, PRA Fundamental Rule 7 | Phase 3 |
| Fieldwork | Entrance meeting, then on-site or remote review led by the examiner in charge | Interviews and office tours; SEC staff do not record meetings | Meetings with senior managers; larger PRA firms moving to a two-year Periodic Summary Meeting cycle from March 2026 | Phase 4 |
| Exit & preliminary findings | Exit meeting with management before the written report | SEC exit conference. FINRA exit meeting, and since March 2026 optional written preliminary findings | Varies with the supervisor and the type of review | Phase 5 |
| Written findings | Supervisory letter or report of examination; MRAs (OCC and FDIC standard codified from 2 November 2026); MRAs and MRIAs at the Fed | SEC deficiency letter, with written notice due within 180 days under Exchange Act s4E. FINRA Examination Report to the CEO | A letter setting out findings and actions; a s166 skilled person review where warranted | Phase 5 |
| Response | OCC: a board-approved action plan within 30 days of the written MRA, if not given during the exam | SEC: generally within 30 days of the letter. FINRA: a formal written response | As the letter specifies; firms must assist a skilled person, s166(7) | Phase 6 |
| Closure | OCC verifies and validates; the Fed relies on satisfactory internal audit validation | SEC closes the exam when staff have no further comments, which is not agreement. FINRA Disposition Letter: No Further Action, Cautionary Action or referral to Enforcement | Confirmed by the supervisor or the skilled person’s report | Phase 7 |
Several of these points are moving. The OCC and FDIC rule takes effect on 2 November 2026, and examiner handbooks will follow. The Federal Reserve’s principles are staff guidance, first issued in late 2025 and revised twice since. The SEC has promised an expanded replacement for its examination brochure, and FINRA now examines some lower-risk firms every six years. State regulators follow their own procedures, so check each timeline against current guidance.
Why Run Exam Preparation in CheckFlow?
No production leaves without sign-off
Each request has a named owner and a due date, the production is attached to its task, and the approver records Approved or Returned before anything is sent. Approvals and conditional logic handle the rest.
Remediation evidence in one trail
When internal audit validates an action or the regulator asks how a finding was closed, export the checklist with timestamps, owners, approvals and evidence.
CheckFlow is a checklist and workflow tool, not a GRC suite, document review platform or regulator portal. Productions still go through the channel your regulator specifies, and confidential supervisory information belongs only where your firm’s policy allows. Our guide to financial services workflow automation explains where that line sits, and CheckFlow’s compliance checklist software covers the rest of your compliance calendar.
Examiners test the programmes behind the paperwork. The AML Compliance Programme Review Checklist, the KYC Periodic Review Checklist and the Employee Compliance Certification Tracking Checklist produce the signed, dated records that answer common requests. See the financial services industry page.
Related Financial Services & Compliance Templates
Frequently Asked Questions
How do you prepare for a regulatory examination?
Start before the notice. Close or evidence progress on every finding from the last exam, check that procedures match what staff actually do, and keep an indexed library of the documents examiners ask for first. Run a mock exam on your highest-risk areas. When the request list arrives, give every item an owner and a due date, review each production before it goes, and route all examiner contact through one coordinator.
What is an MRA, and did the definition change in 2026?
A matter requiring attention is a formal supervisory finding that a bank must correct. Under the OCC and FDIC final rule effective 2 November 2026 (12 CFR 4.92 and 12 CFR 305.1), an MRA may be issued only for an imprudent practice that could reasonably be expected to materially harm the bank’s financial condition or the Deposit Insurance Fund, or for an actual violation of banking law. Anything below that bar is a supervisory observation, with no requirement to act on it or take it to the board. The Federal Reserve applies a similar standard to MRAs and MRIAs through staff guidance.
How long do you have to respond to an SEC deficiency letter?
The SEC’s Division of Examinations says the response is generally due within 30 days of the date of the letter, and should address every issue with the steps taken or planned to fix it and prevent recurrence. Staff generally send any comments within 60 days. When they have none the exam is closed, but that does not mean they agree with your response.
What happens at the end of a FINRA examination?
FINRA holds an exit meeting on preliminary exceptions, then sends an Examination Report to the firm’s CEO. If there are exceptions, the firm submits a formal written response describing its corrective action. A Disposition Letter then treats each exception as No Further Action, Cautionary Action or a referral to Enforcement; FINRA describes the first two as informal dispositions.
Can we share our report of examination with auditors or consultants?
In the US, only within limits. Reports of examination and supervisory letters are confidential supervisory information that remains the property of the agency. The OCC, Federal Reserve and FDIC each set out who may see it (12 CFR 4.36–4.37, 12 CFR 261.20–261.21 and 12 CFR 309.6). Directors, officers and employees can generally see it for business purposes, and the OCC and Federal Reserve rules also allow auditors, lawyers and some consultants or service providers in defined cases. Anything wider needs the agency’s written permission. Log who has access.
Is CheckFlow free for this template?
14-day free trial, no card required. The Business plan is $10 per user per month after the trial. Full details at checkflow.io/pricing.