Would anyone be willing to share what methods you are using for auditing consumer credit reports which are pulled by various bank employees? Or, is it considered such a small risk factor that it does not merit auditing?

Recently we had an issue where a CSR pulled multiple reports without a legitimate purpose. It happened that the person who pays the bills noticed that the CSR had pulled a report on himself as well as other family members.

Any suggestions?

Is there a control in place to reconcile the billing of credit report fees to loans or applications. It seems if someone was pulling credit reports that they shouldn't it would show up on the billing.

Nope...not at our bank.

Well it looks like you have a good reason to recommend such a thing. Perhaps your audit step could be to compare the credit report bill to real applications.

It seems that there is a risk of privacy violations if CSR can pull credit reports on who ever they want.

We have a person who is responsible to match the credit bureau bill against loans made or denied. He is supposed to be looking for exactly that situation. His results are reported to compliance..and no, he does not pull credit reports. We have only 3 people company-wide with that authority(centralized)

Is the entire bill reconciled, or a sampling?

We reconcile the entire bill but we aren't a large bank. It would seem with the issues you are having you might want to reconcile the entire bill for a few months anyway.

When we did a similar audit, we pulled a sample.

Privacy is the least of concerns - see the FCRA:

§ 619. Obtaining information under false pretenses [15 U.S.C. § 1681q] Any person who knowingly and willfully obtains information on a consumer from a consumer reporting agency under false pretenses shall be fined under title 18, United States Code, imprisoned for not more than 2 years, or both.

I agree with Randy. When we performed our audit, we tested to make sure that there was a valid reason for pulling credit reports. We also looked at what departments other than lending were pulling credit reports.

We have faced the same situation of trying to reconcile the bill to actual reports pulled. This can be labor intensive as we order hundreds and hundreds of reports each month. We do Indirect Loans so reports could be with new loans or denied loans. We now do sampling audits and we also created a form that must be signed by each employee authorized to order reports, that details "permissable purposes", responsibilities, penalties for misuse, and has a FAQ section.

I think its a good form, created by our Compliance Officer, and the signed form is placed in the employee's H/R file. I'd be glad to share, if anyone thinks they'd like to see it.

If you e-mail the form to one of the moderators, they can put it in the forms toolbox.


Al

I'll be glad to share. How do I get the email address of a moderator?

andyz@bankersonline.com


Al

Thanks Al. I just sent it to Andy. Just PM me if anyone would like a copy now.

We are a small bank...it is my responsibility to look over every bill and determine that credit bureaus are pulled for a specific purpose. I would recommend that, even in a small bank (we are under $100 million), that the number of people able to pull reports is limited AND that each user have a specific login id. You can then tell who is requesting credit reports on whom.