Compliance in Practice, Part 2 - From Finding to Fix: How to Build an Effective Corrective Action Process

In our last Compliance in Practice post, The Compliance Monitoring Plan: How to Choose What to Test First, we looked at how to decide which areas to review, how often, and how deeply. This post picks up where that one ended. A review has identified an exception, you have assessed its significance, and now the issue needs to be resolved.

That step sounds simple. But in practice, it is where many findings stall. 

A Finding Isn't Fixed Just Because Someone Says It Is

Picture a familiar scenario. A compliance review finds disclosure errors in several loan files. The lending department corrects those files, marks the finding resolved, and moves on. Everyone is busy, and the issue appears closed.

Next month, the same error shows up again. The files were corrected, but nobody asked why the error happened or whether the system, form, or workflow would produce it again.

Correcting the individual error is not always the same as correcting the problem. An effective corrective action process closes that gap.

In a small credit union, this is especially important. Findings often sit between the compliance officer, a department manager, IT, and senior management, each with competing priorities. Without a clear process, a finding can belong to everyone and no one at the same time. 

Start by Understanding the Root Cause

Before deciding how to fix a finding, take the time to understand why it happened. Common causes include:

• Staff understanding. A staff member misunderstood or did not follow the procedure.

• Procedure gaps. The written procedure is outdated, unclear, or silent on the situation.

• System configuration. A system setting, template, or calculation is producing incorrect results.

• Vendor or third-party processes. A vendor form, platform update, or outsourced process is contributing to the issue.

• Workload or staffing. Volume, turnover, or coverage gaps are leading to repeated mistakes.

The cause shapes the response. Retraining will not fix a misconfigured disclosure template, and a system change will not help if staff are skipping a step because the procedure is unclear. Make sure the corrective action addresses the cause, not just the symptom. 

Decide Whether Members Were Affected

Next, determine whether the finding is a documentation gap or something that affected members. Helpful questions include:

• Did members receive incorrect disclosures, fees, rates, or notices?

• Could other transactions outside the sample have the same problem?

• Does the credit union need to correct records, refund fees, provide corrected disclosures, or take another remediation step?

• Are there notification, reporting, or other obligations that need to be evaluated?

The key is to investigate the scope before concluding that a sample finding is isolated. A sample tells you a problem exists. It does not tell you how far the problem reaches. If the cause is a system setting or a shared form, the affected population may be much larger than the files you tested. 

Build a Corrective Action Plan That Someone Can Own

A corrective action plan does not need to be elaborate. It needs to be clear, owned, and kept current. A simple tracker with these fields works well for most credit unions: 

Assign each finding to one accountable owner, even when several departments are involved. Set realistic due dates and revisit them when circumstances change, rather than letting them quietly lapse.

A short tracker that is consistently maintained is far more useful than a detailed document nobody updates. 

Match Escalation to the Severity of the Finding

Not every finding needs the same level of attention. The same risk-based thinking that shapes your monitoring plan should shape your response.

A routine, isolated documentation issue with no member impact can usually be managed by the department leader, with the compliance officer tracking it to completion. Senior management, and the board or an appropriate committee, should hear about findings that involve:

• Repeated errors in the same area

• Actual or potential member harm

• Missed corrective action deadlines

• Significant findings that remain unresolved

Define these thresholds in advance. When escalation criteria are clear, the decision to raise an issue becomes a routine part of the process rather than an uncomfortable judgment call. 

Retest Before Closing the Finding

This is the most important step, and the one most often skipped.

A finding should not be closed simply because training was delivered or a procedure was revised. Those are actions, not results. Before closing a finding, gather evidence that the change actually solved the problem. Depending on the cause, that may mean:

• Reviewing a sample of new transactions processed after the fix

• Confirming that revised system settings or templates are producing correct results

• Observing or testing whether staff are following the updated procedure

• Expanding testing when the original finding suggested a broader issue

Allow enough time for new activity to occur before retesting. If the retest finds the same problem, keep the finding open and revisit the root cause. Document the retest results in the tracker so the closure decision is supported by evidence. 

Turn Findings Into Better Monitoring

Corrective action should also inform what you test next. Findings are some of the best information you have about where risk actually sits.

Repeated disclosure errors, for example, may justify more frequent reviews of that area, a larger sample, or a review of other processes that rely on the same system, vendor, or staff workflow. On the other hand, an area with consistently clean retests may support a lighter review cycle the next time you update your plan.

When you refresh your monitoring plan, look back at the year's findings and ask what they tell you about your risk ratings and control assessments. 

Bottom Line

Compliance monitoring works best as a feedback loop. Findings drive corrective action, corrective action is validated through retesting, and the results shape future monitoring priorities. A finding is truly fixed when you understand why it happened, address the affected members, and have evidence that the problem will not return. 

If your team would like help building a corrective action process or tracking findings through validation, Crimson Oak Strategies is happy to support that work.

Crimson Oak Strategies provides strategic compliance support and guidance tailored to credit unions. Our mission is simple: To make compliance practical. Contact us to learn how we can help.