Wipfli logo
Insights - Articles, Blogs and on-demand webcasts

Articles & E-Books


Internal controls and data tracking financial institutions need during COVID-19

Apr 15, 2020

COVID-19 has caused many financial institutions to implement pandemic or some other emergency procedures, including working with reduced staff and relying on remote access. 

Now more than ever, it is important to review our internal control frameworks and information tracking methods to ensure safe and sound banking operations.

Operational controls

Operating with reduced onsite front-line and operations staff poses unique control issues. Practicing appropriate segregation of duties and obtaining and documenting approvals becomes challenging at a time when strong controls are needed the most. If maintaining the ideal control environment is not feasible, it is important to establish and implement modified procedures to mitigate risks to the extent possible.

Formally addressing temporary control deficiencies reduces the risk that informal processes will be unintentionally created by individuals performing the tasks that may not include sufficient internal controls.

Here are examples of controls to consider when an ideal control environment cannot be achieved:

  • If the cash or night depository verification cannot be processed under dual control, consider counting cash and opening envelops in view of security cameras
  • If individuals authorized to sign official checks are not physically available, consider temporarily modifying the authorized signers or implementing procedures to obtain approval via email when authorized signers are not physically present
  • Instead of removing supervisory overrides if supervisors are not present, consider remote supervisor overrides
  • Use logs to document date, time and reason for access to cash and negotiable supplies
  • Secure any keys or access devices that are not currently being used
  • Sell down floating teller cash drawers that are not in use
  • Sell down excess vault cash or maintain a “working” vault cash supply when dual control over the vault cash cannot be maintained
  • Increase frequency of surprise cash counts for or rotate custody of vault cash supply biweekly, particularly when there is a single vault custodian
  • Increase monitoring of branch capture, remote deposit capture and mobile capture reports for suspicious activity
  • Review inclearing large dollar items to quickly identify potential fraudulent checks

COVID-19 loan deferrals controls and data tracking

Lenders and processors are overwhelmed with customer questions and requests and are working long hours at a very quick pace to get loan deferral requests processed. Here are few items to consider investing time in up front that will save time in the long run:

  • Consider outlining the modification process, including information required, approval authority, recordkeeping and review requirements specific to the COVID-19 loan modifications to present to the board of directors for approval. While the Loan Policy would cover modifications generally, the nature of this specific situation could create loan policy exceptions. Having board-approved guidelines would eliminate the need to document policy exceptions and clarify management’s expectations for processing COVID-19 modifications. The approval authority should consider efficient processing and safe, sound and prudent lending practices.
  • Create a simple “COVID-19 Modification Request” form to document that the following requirements provided in the April 7, 2020, Interagency Statement on Loan Modifications and Reporting for Financial Institutions Working with Customers Affected by the Coronavirus (Revised) were met to qualify the loan:
    • Reason loan modification is related to COVID-19
    • Documentation to indicate the loan was less than 30 days past due as of December 31, 2019
    • Date of modification. Modifications should be processed between March 1, 2020, and the earlier of 60 days after the termination of the National Emergency or Dec. 31, 2020
    • Documentation of individual approving the loan modification
  • Section 4013 if the CARES Act, Temporary Relief from Troubled Debt Restructures, indicates that financial institutions should maintain records of the volume of COVID-19 restructured loans. Consider adding a user-defined field to flag loans, which would create a field that could be queried to generate a report. If that is not available, a manual spreadsheet should be maintained.
  • The bank should establish strong controls over core system changes to loan terms resulting from COVID-19 modification.
    • The individual updating the modified terms on the core system should be different than the individual verifying the changes. Ideally, the person responsible for verification should not have access to make changes to the core system.
    • Loan maintenance reports should be reviewed daily. The updated terms should be verified to the signed modification document and the individual performing the verification should sign and date the maintenance report to document the review.

Board reporting

The board of director’s responsibility to oversee the financial institution’s risk management framework and ensure safe and sound operations is imperative during this time. The board should be kept informed of the changing regulatory and risk environment.

The board should consider temporarily reviewing and/or approving the following:

  • Changes to policies, either permanently or temporarily related to the response to COVID-19. Areas that may be impacted could include, but are not limited to: loans, investments, asset-liability planning, audit programs or compliance activities
  • Significant changes to internal controls due to operating under emergency guidelines
  • Policy exceptions, including investment exceptions such as the sale of held-to-maturity investments sold to meet liquidity needs during the COVID-19 response
  • Items related to liquidity
    • Trends of large depositors to identify run off
    • For banks with large serviced loan portfolios, the status of delinquent mortgage payments made by the financial instruction to monitor impact on liquidity due to funds being paid to the servicer that have not been received by the borrower.
  • Items related to lending
    • List of COVID-19 loan modifications
    • Modifications to insiders, including controlling shareholders, directors, officers, employees or their related interests
    • Concentrations of credit by industry to identify segments of the loan portfolio that may be at a higher risk of distress due to COVID-19

As the formal record of the board’s actions during the COVID-19 response, minutes and board packets should clearly and accurately reflect discussions, items reviewed and approvals to support the board’s active involvement in the managing the financial institution’s role in the national emergency response.

Finally, management should be proactive in establishing the modified control environment and tracking information related to the COVID-19 response. While it is difficult to maintain ideal controls during this unique emergency response, it is important to implement modified processes and procedures and reinforce expectations for operating in a safe and sound manner.

Need more help with COVID-19 issues?

We’re here to help you navigate the uncertainty of the COVID-19 pandemic and its impact on your people, finances and business. We have developed a library of resources in our COVID-19 resource center to help you stabilize today and prepare for tomorrow.

See our articles on:

Talent and strategy
Business finance
Legislation and regulation
Personal finance


Danielle M. Heidemann, CIA
View Profile

Need help now?

Navigate the impact of COVID-19.


Fill out the form below and a member of our team will get in touch with you.

COVID-19 resource center | Wipfli