Christine Thomas

A bank or credit union should evaluate a banking intelligence platform by testing it on the institution's own risk, compliance, lending and operational records against seven criteria, and by keeping the third-party...

Credit union risk management at a small credit union needs seven elements drawn from NCUA rules and examination procedures. These elements include board oversight, an annual supervisory committee audit, written bo...

The red flags in vendor due diligence are findings in a third party's file that question its ability to perform the activity safely. This could include exceptions on relied-on controls, a carved-out subservice orga...

Control mapping connects each statement in a bank's policies to the regulatory requirement it implements, the control that enforces it, the person who owns that control, the test that checks it and the evidence the...

Vendor risk tiering at banks and credit unions works by scoring each third-party relationship on inherent risk before controls, testing whether it supports a critical activity, and assigning a tier that sets due di...

Banks and credit unions use a vendor onboarding checklist by fixing the business owner, intended activity, criticality call and approver before the vendor is contacted, then working through planning, due diligence ...

Human in the loop AI is needed wherever an AI-assisted compliance output becomes a decision a US financial institution must own and explain, such as a Regulation B credit denial or a suspicious activity report fili...

Banks and credit unions connect fraud and AML risk signals through FRAML: defined fraud alerts and confirmed losses go to the BSA/AML team for a suspicious activity report decision, and AML findings such as money m...

Unified data supports compliance reporting by holding every obligation, policy, control, test, issue and piece of evidence in one connected record with shared identifiers, so a bank's board, management and examiner...

A bank evaluating compliance reporting software should ask eight questions in three groups: Whether the reports cover every audience and every part of the compliance management system Whether each figure can be...