What are the internal control issues with everyone in the loan department (officers and operations) having access to run credit reports?

Each should have a unique signon so that you can determine which user accessed a report. Training requirements should also be in place for each so they know when and why they may access a report.

So glad to be reassured. We are implementing software whereas credit reports can be retreived by officers. They are identified on the cr bureau billing by ID codes. They have also been trained. The billing will be reconciled to loan applications to ensure each report was pulled for a legitimate business reason.

During a recent FDIC exam, the examiner asked for a monthly statement from the credit bureau and traced each report to an authorized purpose.

At my former employer I performed an audit using that same logic.

I use the same technique. The first time I did it I was scared to death of what I thought I might find. But as went well. The bills come in by machine so I could differentiate between loans, loan admin and HR. I found applications, denials and authorizations on each.

Thanks for all your input. I guess I will have to begin to review this area.

This is a very good audit to conduct if you aren't already. What you are looking for (or hoping not to find) is an authorized credit report. If you find this, it is very much like a fair lending issue.

In reply to:

---

What you are looking for (or hoping not to find) is an authorized credit report.

---

You mean unauthorized.

Some years ago when I did this I found several folks who were on the HR billing statement who had recently been promoted. I asked if this was common, accessing a credit report for a promo. The HR person said no, she was just updating the reports. Many of these employees were long term. and I knew FCRA authorization forms were part of the new hire package. But we'd not gone back to get perpetual authorizations from existing employees. That update process was stopped.