We have written procedures for force placing flood and hazard insurance. I recently completed an audit to make sure procedures were followed. We have multiple customers who never received a notice from the bank that their force placed policy was going to expire and they should try to obtain insurance. We charged these customers for the force placed policy.
I am not sure what to do? What's done is done and do it right going forward? Look back to October 2013 and refund premiums to customers because they were never notified of the force placed insurance?
Thank you!

You are talking about two different animals (hazard and flood insurance) as the notification processes are not the same.

I would fix going forward and determine whether the past practice could be deemed a UDAP by the regulators.