I've been tasked with the annual review of our policies and procedures. Does anyone have any tips they want to share? I've never done this before and it seems like such an overwhelming task. I'm assuming I'd review them existing P&P versus the applicable regulations to see if there have been any changes to the regulations?

Comparing them to regulation is a good start, but also interview staff tasked with following said policy and procedures to ensure that actual practices are reflected in those documents. It’s amazing how many audit and exam findings result from, “I heard we were supposed to...”

If you have a Compliance Committee I suggest taking this project to them so each department can evaluate the documents that apply to their area. If your bank does not have a compliance committee, now is a great time to form one.

Thank you BrianC!

Are you being asked to conduct a review only from a compliance perspective or are you being asked to be the only one bank-wide to review policies and procedures?

Thank you P*Q, I work for a mortgage lender. I'm being asked to complete the annual review of all our policies and procedures. And, unfortunately we do not have a compliance committee so I have to inquire about any changes to processes based on the policy approvers/owners. It's very confusing. I'm new to this company and new to a lot of this. Previously I was 100% dedicated to HMDA so this is all very new to me and quite overwhelming. I refuse to give up hope while I plaster this board with dumb questions while I take courses and train on my own time and dime. Sorry for the long winded answer...

My tips:
Policies should stick to the what and why. Go no further.
Procedures get into the who, when, where and how. Go as deep into details as your risk assessment determines (based on previous audits, monitoring, and other risk factors).

Procedures should be written by the personnel that do the tasks and then reviewed by the compliance officer or others with subject matter expertise. If you write procedures for someone else, the first thing they think is "you don't know how to do my job" or "you don't know what it's like on my side of the desk" and they're right. So have them write the procedures. This way they take ownership.

David, thank you! You are soo right about the procedures. If I outline how they should be doing their job/tasks, the procedures will be ineffective and not followed.

We have a tickler system for our procedures. The first of each month an email is sent out listing any expired/expiring procedures. It is up to the responsible person to update them and submit them for review to their manager to be updated in the system. It's a way to keep on top of them. If there are any changes to the procedures (new vendor, etc) we are responsible for updating our procedures as soon as we've worked out the new kinks.

we have a number of policies (ie - lending, wire) that require annual ratification by the Board, even if there are no changes. 3 months prior to the December BOD meeting, the BOD secretary notifies each of those areas asking if there are changes to policy.

other policies are changed as circumstances dictate (ie - disaster recovery, social media).

procedures are housed within LOBs, managers/line staff are responsible for updating as needed and, depending on the area, reviews may need to be done by areas such as internal audit, enterprise risk, and compliance.

Policy never includes procedures, but procedures frequently quote policy.

We have similar setup to what Happy described. Policies are the responsibility of the area owner (BSA - BSA Officer, Credit, Chief Credit Officer, etc.) and procedures are tied to the specific LOBs. Some LOBs have "Standards" which are more detailed than procedures.

When IA or Risk conducts this review they look at it to see if the policy matches the regulation(s), if the procedures are reasonably designed to ensure compliance with the policy, and are personnel actually following the procedures and/or standards.