I am auditing adverse action requirements under regulation B for a commercial lending institution (they do not originate retail consumer loans). Their records indicate only one denial in the last 12 months, but the business had revenues over $1 million so, by law, the bank was only required to retain records of the notification for 60 days. This was at the beginning of the year. What should my procedure be to test for compliance since I don't really have anything to test? Should I just document their process and look for any holes they might have in the procedure?

Should I just document their process and look for any holes they might have in the procedure?

That is what I would do and then I would also look for other instances of denial. Not knowing the overall volume of commercial lending at this institution, I would say this is a "suspect" denial rate. Focus on the application and application tracking processes. Review loan committee minutes to determine whether any other loans were discussed that did not result in an origination, etc.

The loan volume is VERY low. I pulled all the credit report requests and compared them to the loan portfolio to try to back into denials that weren't documented, but I have to say that there was only one that wasn't originated and they documented the tracking system comments that it was withdrawn by the applicant.

I'm at a loss for how to find anything that they are looking at and denying before they pull credit though. I'm not sure how to find it.

Thanks for the advice on loan committee minutes. I will take a look at them and see if anything turns up.