Credit Union Exam Solutions Presents With Flying Colors

Speaker: Hey, everyone.

This is Mark Trakel with another
episode of With Flying Colors.

Last week, I did a training session, for
a credit union, senior executives, but

mostly for the supervisory committee and
some board members about, the importance

of the, 5300 and, the call report.

When I prepped for that and
I got done with it, I thought

this would be a good podcast.

So here it is.

I've got the PowerPoint, edited a little
bit no reference to who the client, was.

Hey, everyone.

This is Mark Trakel with another
episode of With Flying Colors.

Today, I'm gonna talk about the 5300
and the call report and why it matters

to you, why it matters to NCUA.

I did a presentation to a credit union
last week on this topic, and after I was

done, I thought, this would be something
good to share via the podcast as well.

So we're gonna talk about why the call
report matters, and it's gonna present

a risk view from the NCUA side of the
table, what it means to NCUA, and why

it's important for them, and again,
why it should be important for you.

So the, NCUA uses it as a risk supervision
tool and a way of m-monitoring the

financial health of credit unions.

And I'm gonna quote some things from
NCUA so you have specifics here.

NCUA collects and analyzes information
from credit unions to assess their

financial condition and evaluate existing
and potential risks to the National Credit

Union Share Insurance Fund, also known
as the NCUSIF, also known as The Fund.

So a couple more quotes
on financial health.

Call report data is vital to assessing
a credit union's financial health.

Risk-focused exams.

NCUA has risk-focused exams.

By the way, I just did a podcast on the
entry letter, for the NCUA exam, and

if you didn't see that video or watched
that, listened to that podcast, it's a

very good one, in my opinion, because
there's a lot of meat in that, the,

the changes that NCUA made there that
I think are gonna make exams better

if they follow, what they've written.

But anyway, risk-focused exams.

NCUA's risk-focused exam
program relies heavily on the

accuracy of call report data.

If they're gonna figure out where they're
gonna spend their time, particularly

in an era where they're down 27% of
staff, having good data, is essential

to them being able to make the best
decisions on where to send staff.

And then accuracy.

Inaccurate information impairs
an examiner's ability to properly

identify and assess risk.

That's why if you're listening to this and
you've had errors in your 5300, you know

that they, get pretty I don't wanna say
aggressive, but they will, have findings

or doors to make sure that you fix them.

And, they also view that, and we'll get
into that, they view that as a kind of a,

a precursor on how your internal controls
actually work at the credit union.

And these come from, the various
reports, the call report, NCUA

examiner's guide, via NCUA's website.

So this is, of all the slides,
this is a little bit more opinion,

than, than some of the other
slides, but where is NCUA heading?

It's, in my opinion, it's heading
towards data-driven supervision.

Now, earlier this year, they
proposed their new strategic

plan, and again, another quote.

So the strategic plan says, "More
closely integrating advanced

analytical anal-analytics and enhanced
decision-making supports tools into

examination scoping, scheduling,
and CAMEL's rating processes."

That's NCUA's strategic
objective one point three.

Also, the 2024 annual report said,
"By analyzing much of a credit

union's financial and operational
condition remotely, NCUA says it may

be possible to reduce the frequency
and scope of on-site examinations."

And I know you're all for less frequent
exams, and a, a shorter scope, right?

And I see, NCUA, so they've said they're
gonna use it on exam scope, exam timing,

and it's gonna impact CAMEL ratings.

Call report data is that main
fuel, and errors in that can impact

how you're supervised, right?

A, if they think you have errors,
they're gonna show up and, B, if you

give them bad data, it could have them
show up when they might not otherwise.

All good reasons to,
have an accurate 5300.

that was all before artificial
intelligence, AI, if you

will, and, that has taken off.

NCUA has talked about they want to
tap into AI, and it is a great tool

of leveraging, as in your credit union
and perhaps personally if you use AI.

It's a great tool to leverage.

Eventually, I think NCUA will be going
more towards, less on site, more virtual,

and they need good data for that.

I've also heard a rumor, and I will
emphasize a rumor, that they may

be looking at re- Redoing MERIT
or adding some functions to MERIT.

And when I think about that,
why would they do that so

soon after MERIT was launched?

Perhaps to take advantage of artificial
intelligence and have more off-site exams.

So is the money slide if you're,
in my opinion, if you're, watching

this or if you're listening.

I'll walk through it.

But, there are six main reasons,
why the 5300 program matters.

Number one, it's NCUA's primary lens.

You file it quarterly.

It's how NCUA monitors you between
exams and scopes the next one.

It tells your story before an examiner
arrives, and it tells that story

all the way up the chain to the
regional director and every level of

supervisor in between, 'cause they run
risk reports on it, and that, again,

determines where, how risky they think
you are without being there, and it

determines when they might come back.

It also plays a key role in
setting a capital classification.

So it determines what your
prompt corrective action is.

It determines what your risk-based
capital calculations are.

And it comes from that quarterly data.

And then the act and the regulation
drives, when, if you fall be- below seven,

you're between six and seven, you've gotta
request earnings, earnings waiver letters.

If you fall below six, you have to
have a, a, a capital restoration plan.

And it's driven by the, those,
those numbers, and it's, the dates

that when you have to submit it are
driven by when you submit that data.

So it's also a legal filing.

An officer declares it's true and correct.

Late or false or misleading reports
can carry civil money penalties,

and errors must be corrected.

Now, as it relates to civil
money penalties, NCUA,

doesn't do that very much.

They'll do it if you're late or
historically late, but they've, th-

they're not aggressive as an agency as
it relates to civil money penalties.

It's also a public document.

That's another thing,
that makes it important.

Anyone can pull it from NCUA's
website, your members, your peer

credit unions, banks, the media,
analysts, or potential merger partners.

So again, it kinda says, "Hey,
here's what our numbers show we are."

And it supports the insurance fund.

Insured de- shares drive your
1% NCUSIF deposit and feed the

fund's equity ratio, which decides
whether NCUA charges a premium.

Now, there's much debate, in my mind,
on whether or not, all credit unions

get that insurance calculation correct.

Perhaps NCUA's enhanced their tools
relative to, making sure that they get

that correct, but it was always something
that I think NCUA could have d- needed

to take some actions, to try and improve
the accuracy of what it is that you need

to put on deposit in the insurance fund.

And it's a, as I mentioned earlier,
it's a proxy for internal controls.

Accurate, on-time reports
signal controls that work.

Amendments and recurring errors
i- invite a closer look, and

indicates that there might be
something wrong at the credit union.

And if there's challenges getting the
5300 right, NCUA might have reason to

believe that there are other issues
that they should be looking at.

So again, errors means they'll
come back more often, another

reason, to not make any.

And a, an error on a 5300 might
look like it's minor, but it

does catch NCUA's attention.

What NCUA's rules ask for of
the supervisory committee as

it relates to their operations.

So now I'm pivoting away from just the
5300 and into the role of the supervisory

committee, which was also part of what
we chatted about, last week, in a credit

union somewhere in the United States.

So the rule tie- the rule ties
controls to the call report.

NCUA defines reliable financial
reporting as preparing call

reports that meet management's
financial reporting and objective.

And if you're looking at
the PowerPoint, it lists the

regulation here, that applies.

The committee must ensure the credit
union meets call report measurement and

filing requirements, and that reports
are promptly prepared and accurate.

So management prepares them,
the committee checks them.

The committee owns the
auditor relationship.

The audit engagement is
contracted directly with the

committee, and the auditor reports
internal control concerns to it.

Total assets on the year-end call
report determines which annual

audit the credit union must obtain.

And of course, if you're over $500
million, that's a CPA opinion audit.

If you're under $500 million-
it lays out agreed-upon

procedures that must be included.

And again, the rule's verb is to
ensure that it's done, not prepare it.

How oversight happens matters
as much as whether it happens.

The committee is the members' watchdog.

It doesn't prepare the call
report, it gets assurances that

the process producing it is sound.

And the NCUA's Examiner's guide
says, "The supervisory committee

is responsible for reviewing and
monitoring internal controls,

including reviewing and appraising
the work of internal audit staff."

Now, the internal audit
is the committee's engine.

You have risk-rated audit plan,
enterprise risk management ranks

audits areas, so attention goes where
the risk is, and that's if you're

big enough to have an enterprise
risk management, tool or committee.

It needs to be independent
with recurring reviews or, a, a

outsourced internal audit partner.

You can hire them to have belts and
suspenders so that they can take a

look at it, a l- for the committee
or it can be done by internal audit,

but it can't be, the review process
cannot be done by management itself.

Another set of eyes on call reporting,
if you have an outside firm or an

outside or an int- internal auditor,
they can look at it quarterly.

Findings flow to the committee.

NCUA expects internal audit and
report to report all findings to

the committee and follow up to
make sure that they're resolved

Where the committee adds the most value.

Now, the committee's focus is in, is the
process sound, preparation, independent

review, reconciliation to the general
ledger, whether internal audit risk-rated

work is sound, audit and exam findings
and whether or not they're resolved, so

they should be following up on what NCUA
asks to be done, and amended call reports.

Why were they needed?

Were there systems put in place to
make sure it didn't happen again?

The flip side of that is what
management does, internal audit…

Management does, excuse
me, internal audit tests.

So line-by-line preparation and
account mapping is management.

Day-to-day reconciliation, management.

Operational process design
is a management issue.

So for the call report, the committee's
core question is simple: Is the

process that produces the number sound?

NCUA's recommended practices
for the call report.

Now, this is from the examiner's
guide, and again, a guide is not a

regulation, and they're doing less
guide-type things under the Trump

administration, across all agencies.

But, this is still out there
a- as of today's publication.

So management owns it.

Management is responsible for overseeing
call report and profile reporting.

Again, there's the profile which
lists your field of membership, are

you a low-income designation, dated,
how many branches you have, who

your board members are, et cetera,
et cetera, and other things there.

But that's a management responsibility.

Documented review before submission.

A written review process to detect
and fix errors prior to filing.

So you should have a file
that shows that is support.

So if NCUA comes in and says, "How did
you get your, this number of HELOC loans?"

Or, "How did you get
this number of branches?"

Or, "How did you get this
number of delinquent loans?"

There should be some sort of mapping,
documentation that NCUA can review.

There should be work papers behind
every line, it should be reconciled

to the general ledger, and the
preparer and review, it should

be a separation of, of duties.

There should be a preparer and a
reviewer that are different people.

And vendors should be vetted.

Any third party that helps prepare the
report has its own review process, and

the credit union does due diligence.

By the way, the banking regulators,
including NCUA, are looking

at changing how they look at
third-party due diligence.

So the, for the committee, these
are things that NCUA does, but these

are questions to ask management.

Again, not to perform So five questions
from an e- examiner's perspective

that they can look at every quarter.

What changed the most
this quarter and why?

Did we report any…

Did we, did the credit union, report
anything different than last quarter?

Are there any new services?

Who reviewed it, and how was it
reconciled to the general ledger?

Are there any known errors
or pending amendments?

How do our key ratios compare to
peers and our own policy limits?

Because NCUA, i- is aggressively looking
at what your policy limits are and

making sure that you have good governance
and don't violate your own policies.

So again, the examiner looks
for adverse trends, unusual

growth, and unexplained changes.

If management can answer these
readily, that's a good sign

that the process is working.

And lastly, here's some citations
on, the Federal Credit Union Act.

Section 202,

various sections of Section 202,
discuss, the 5300 and ga- data gathering.

For example, 202(6) is the regulation
that says, that, if you're over 500

million, you need a CPA, opinion
audit, and, that if you're over

10 million, you need to file GAAP.

And then there's a few
regulations, that apply to this.

741.6,

715.2,

715.3,

and 715, 715.4.

I'm not gonna go into those specifics,
but if you wanna go check them out,

there's the numbers that tie to that.

So that's the end of what I wanted to
tell you here about the 5300, the call

report, and the supervisory committee,
responsibilities related to it.

If you do it right, it
helps you get a better exam.

And I do believe that NCUA will be
using this more and more as opposed

to less and less over time, and that's
because of the world we live in with AI.

They're gonna wanna be able to
be as efficient as they can.

They're going to eventually want to
be able to take advantage of AI tools,

to do a lot of your exam off-site.

And in the end, I think
that works well for you.

As always, I wanna thank you for
watching or thank you for listening.

Please, subscribe, on, on YouTube or
Spotify or Apple, wherever you get this.

It'll help my algorithms and
get this message out to more

credit union folks out there.

Again, appreciate your time.

This is Mark Trakel, signing
off with flying colors.