Management controls at the Asset Management and Assistance Center (AMAC) were shown to adequately protect personally identifiable information (PII) in liquidations of credit unions from 2008 to 2018, according to a report published recently by the National Credit Union Administration (NCUA) Office of Inspector General.
This self-initiated review, the OIG wrote, followed objectives developed from the office’s 2019 annual performance plan and focused on full liquidations and liquidations with purchase-and-assumption transactions during the 10-year period covered. The objectives were to determine whether: 1) AMAC management’s control activities that supports the liquidation process adequately considers and safeguards PII from initial identification to destruction; and 2) AMAC’s liquidation activities comply with applicable policies, procedures, laws, and regulations as they relate to the protection of PII.
“Our audit determined that AMAC had adequate controls over all three areas of the liquidation process to safeguard PII,” the report said. The OIG found that AMAC staff considered the safeguard of PII during the (1) pre-liquidation planning process, (2) records maintenance, and (3) destruction of records of liquidated credit unions. “We also determined that AMAC staff generally complied with all applicable policies and procedures related to protecting the records that contained PII found when liquidating credit unions,” it said.
“Applicable policies and procedures” may be the operative phrase here. In the report, the OIG said it was unable to test controls over the records destruction process during the scope period. Reasons were that AMAC: (1) had not implemented policies or procedures over the destruction of records; (2) was advised in 2016 to defer records destruction until updated records schedules for liquidation records were approved by the National Archives and Records Administration in 2017; and (3) was reluctant to dispose of such records until the process with the secured warehouse contractor could be established.
The report recounts various iterations of the center’s records schedule and related documents that had conflicted with the Federal Credit Union Act. “To mitigate these conflicts, an AMAC official informed us that they began working in 2013 to update the records schedule to include a distribution timeframe consistent with the FCU Act and other federal records schedules,” it stated.
A records schedule was implemented in December 2017, and the OIG found that this improved AMAC’s process for the safeguard of PII in the destruction process. Also, after the scope period of the audit, AMAC issued a new policy titled Hard Copy Record Destruction that incorporates the destruction process with the secured warehouse contractor.
“In July 2019, having finalized the process with the secured warehouse contractor, AMAC resumed destruction of liquidated credit union records. We reviewed the secured warehouse contractor’s certificate, which provided confirmation to AMAC that the contractor had destroyed the records.” Given the improvements, the OIG said it was making “no recommendations at this time.”