An audit of the federal credit union regulator’s consumer complaint program produced good marks overall but identified issues surrounding internal controls over complaint processing and communications with stakeholders, a report released recently shows.
The audit by the National Credit Union Administration (NCUA) Office of Inspector General (OIG) was self-initiated and covered the period of Aug. 24, 2015, through June 30, 2018.
“Results of our audit determined that overall, the NCUA processes consumer complaints efficiently and effectively and in accordance with applicable laws, regulations, policies, and procedures. We also determined examiners use consumer complaint information and trends data during pre-exam scoping activities,” the OIG audit report, dated Feb. 9, said. “However, we noted some areas where the agency could improve internal controls over the consumer complaint program.”
The OIG made nine recommendations for NCUA management and offered three suggestions. Recommendations focused on improving internal controls over the Salesforce system, monitoring needed for the consumer complaint process, and the need to improve communication with both external and internal stakeholders:
- Maintain a complete audit trail for all cases entered into the Salesforce system. Management response: Indicated they will maintain a complete audit trail for all cases entered in the Salesforce system and will perform quarterly audits tracing samples of cases through the system by no later than Dec. 31, 2021.
- Improve and document Salesforce internal control responsibilities to include developing policies and procedures related to the deletion of consumer complaint cases; periodically assessing user roles to determine required system permissions and provide access that allows for least privilege; and performing and documenting periodic reviews of Salesforce generated audit logs. Management response: Indicated they will update existing internal control responsibilities related to the deletion of consumer complaint cases and update documentation accordingly to reflect improvements by Dec. 31, 2021; and periodically assess user roles for relevance and accuracy and perform quarterly reviews of Salesforce generated audit logs beginning Dec. 31, 2021.
- Establish a formal process to monitor the effectiveness of internal controls over the consumer complaint process to include quality control reviews and timely remediation of internal control exceptions. Management response: Will do by Dec. 31, 2021.
- Periodically review the Operations Manual to ensure it includes relevant information, addresses all control risks, and management holds employees accountable for following established policies. Management response: Will review the Operations Manual to include relevant information, address control risks, and provide employee accountability by Dec. 31, 2021, and at least annually thereafter.
- Revise policies and procedures related to determination letters to ensure the agency communicates a clear, and accurate message to both consumers and credit unions. Management response: Will do by Dec. 31, 2021.
- Revise the Supervisory Committee Guide for Federal Credit Unions to reflect the current consumer complaint process and responsible office. Management response: Will draft language for inclusion in the appropriate guide or manual reflecting the current consumer complaint process and responsible office by June 30, 2021.
- Establish a process to solicit input from consumers and credit unions to identify issues in the consumer complaint process and use resulting input as appropriate to improve the NCUA’s consumer complaint program. Management response: Will do by Dec. 31, 2021.
- Finalize and issue an Instruction outlining the roles and responsibilities of the NCUA’s consumer complaint process to ensure consistent and relevant guidance for all NCUA staff to include consumer protection laws and regulations that the NCUA enforces. Rescind or cancel all NCUA or regional Instructions no longer applicable. Management response: Will issue an Instruction by Sept. 30, 2021, concurrently cancel any related Instructions no longer applicable.
- Communicate comprehensive pattern and trends data, complete with analysis, related to the NCUA’s consumer complaint program to assist internal stakeholders with understanding consumer complaint data to meet the agency’s consumer compliance objectives. Management response: Indicated they will expand existing efforts to communicate such information by June 30, 2021, and quarterly thereafter.
The NCUA OIG also offered three suggestions for improving the efficiency of the consumer complaint process. The report said recommendations followed a judgmental sample of 40 closed complaints, with reviews of each phase of the process to determine timeliness of processing. Key findings noted a lack of performance goals for the Consumer Assistance Center (CAC, housed within the agency Office of Consumer Financial Protection) and delayed responses or resolution where credit unions did not respond within a specified 60-day timeframe.
Suggestions, and management responses, include:
- Conduct quarterly reviews to determine whether analysts uploaded violation data in the CCV module at the time they closed complaints. Management response: Will do no later than Dec. 31, 2021.
- Establish performance goals for the Consumer Assistance Center. Management response: Will do by Sept. 30, 2021.
- Implement measures to ensure complaints, within CAC purview, are delivered to all credit unions within ten business days. Management response: Will implement a goal of delivering 95% of complaints within CAC purview to credit unions within 10 business days by June 30, 2021.