Just want to clarify if the SAFE Act is considered Compliance or Safety and Soundness for audit purposes...

I don't think the examination procedures are out yet, so it is hard to tell.

Our external auditor thought maybe Compliance and checked to make sure we had our Policy and Procedures while doing Loan Compliance. But said he was not sure.

Once the registry is up and running, will your Internal Auditor handle the annual independent testing or will it be outsourced to an external auditor? Our Internal Auditor was wondering about any confidentiality issues involved with the results of the criminal background checks on MLOs. Normally all audits of HR are handled externally. Would you have 100% of the registrations audited or would you just test a representative sample?

We (Internal Audit) will be performing the SAFE Act audits. For us, only the Director of IA can perform HR and payroll audits so it will likely be the Director who will have to perform the SAFE Act audit.

Like all other areas of auditing, auditing on a sample basis should be sufficient as long as your sampling techniques are adequate and sound.

FWIW - I know a few outsourcing firms that are adding this to their compliance, not S&S-related audits.