Industry
Regional banks.
Asset profiles between $10B and $100B. CCAR, DFAST, heightened standards, and an examination cadence that does not pause.
Crossing the $10 billion threshold pulls a bank into a different regulatory universe: the CFPB as a direct supervisor, heightened standards under OCC Heightened Standards or its FRB equivalent, DFAST stress testing, and an examination cadence that is no longer episodic. The institution that arrived at $10.1B is not yet the institution it needs to become to live there.
Our practice for regional banks — typically $10B–$100B in assets — is built around three transitions: building a risk and control infrastructure proportionate to the new regime, validating the models that the regime now requires (CCAR/DFAST loss forecasting, AML detection systems, AI/ML underwriting), and running an internal audit function that the audit committee can rely on as a true third line.
The pace is the hardest part. A regional bank is being examined for something somewhere on most weeks of the year. Our presence is calibrated to that.
| Regulator | Authority |
|---|---|
| FRB · OCC · FDIC | Primary federal — heightened-standards regime |
| CFPB | Direct supervisory authority above $10B |
| DFAST | Annual loss forecasting cycle |
| Basel III | Standardized + advanced approaches |
| FinCEN | Heightened scrutiny on TM, sanctions |
| FFIEC · FRB | IT / cyber — annual examination cadence |
- Model validation — CCAR/DFAST loss models, AML detection, AI/ML underwriting — independently validated under SR 11-7.
- Internal audit — Co-sourced for specialized capacity at a third-line caliber the committee can rely on.
- SOX compliance — For public regional bank holding companies — scoping, testing, deficiency aggregation, ICFR conclusion.
- Board reporting — Reporting that meets heightened-standards expectations without disappearing into volume.
The bank's DFAST submission for loss forecasting was returned with a finding that conceptual documentation was insufficient for the FRB to assess model risk. We performed the validation that should have accompanied the original submission, documented the methodology to the standard the FRB cited, and presented the results to the model risk management committee. Edgar led; the partner who validated also briefed the committee.
What the audit committee saw
- Finding 01 Conceptual soundness re-documented in 38 pages — the methodology, the alternatives considered, the data appropriateness.
- Finding 02 Backtesting and sensitivity analysis added, with monitoring thresholds for the next cycle.
- Finding 03 Subsequent submission accepted without resubmission request.