CRA's each have their own way of billing. Equifax (small user), provides a detailed listing of reports pulled, and includes who pulled the report. On larger accounts, it may be possible to get the information in an excel file.
If Loan officers can pull credit bureaus from a laptop, you may want to include the step that reports are pulled during [normal business] / [reasonable] hours. Many (many) years ago, I was doing a similar audit and noted that one of the reports was pulled after midnight. After discussion, the LO admitted meeting someone at a lounge, and he got enough information to pull her credit report (from his laptop on his kitchen table on a Saturday night) to make sure she wasn't pulling to much baggage. It resulted in an immediate termination.
_________________________
Integrity. With it, nothing else matters. Without it, nothing else matters.