Regulatory exam preparation starts with three priorities completed in the next 48 to 72 hours: a risk-focused gap analysis mapped to current examiner priorities, a centralized and secure repository of likely CIDR and Entry Packet documents, and a timed mock drill that tests retrieval before an examiner does. Agency signals from the SEC, FINRA, and FDIC shape what gets tested this cycle, and firms that align their readiness work to those signals walk into exam week with fewer surprises and a shorter follow-up list.
TL;DR:
- Firms should conduct a risk-focused gap analysis aligned with current examiner priorities within the first 48 to 72 hours to identify critical vulnerabilities.
- Building a secure, organized document repository of key records like supervisory procedures, testing reports, and transaction samples can significantly reduce retrieval delays during exams.
- Pre-exam mock drills should replicate real CIDR requests, involve key personnel, and identify common issues such as inconsistent file naming or missing remediation trails.
- Prioritizing preparation on areas with high client harm potential—such as custody, fee calculations, and AML monitoring—improves exam outcomes and reduces follow-up work.
- Using automated platforms that produce timestamped, audit-trail evidence speeds response times and diminishes examiner follow-up requests, especially when integrated with cybersecurity and control standards.
Maintain 100% NCUA & OCC Audit Readiness
Monitor regulatory updates 24/7, check internal credit policies, and generate compliance trails with Erina (AI Regulatory Agent).
Table of Contents
- What examiners look for in a risk-focused examination
- Pre-examination planning, timelines, and the Entry Packet
- Document and evidence checklist for the CIDR and on-site testing
- Turning gap analysis into documented evidence
- Running a mock CIDR drill before the examiner arrives
- Study resources, certifications, and training that build readiness
- How automation speeds examiner responses and reduces follow-up
- A compliance leader's short checklist of priorities
- RiskInMind: a demo built around examiner-ready reporting
- Sources
- FAQ
What examiners look for in a risk-focused examination
Examiners do not run a fixed checklist against every institution. The SEC's Division of Examinations and the FDIC both describe a risk-focused approach that tailors scope to a firm's products, client base, prior findings, and overall risk profile, so two firms of similar size can face very different document requests. A firm with a complex advisory business and custody arrangements draws different scrutiny than a community lender focused on consumer installment loans, and supervisory history plays into that scoping decision as much as the business model itself.
Several substantive areas recur across sectors because they carry the highest potential for client or consumer harm:
- Anti-money laundering and Bank Secrecy Act compliance, including suspicious activity monitoring and reporting
- Custody and safekeeping of client assets, with particular attention to control and verification
- Fiduciary duty and Regulation Best Interest obligations for advisers and broker-dealers
- Valuation practices, fee calculations, and expense disclosures
- Cybersecurity, operational resiliency, and third-party vendor oversight
Annual priorities publications give firms a preview of where that scrutiny lands this cycle. Both the SEC and FINRA flag fiduciary duty, custody, and technology risk as 2026 focus areas, with FINRA's 2026 annual regulatory oversight report highlighting generative AI and third-party risk management alongside the perennial custody and fee concerns. Those publications function as strategic guidance rather than new rules, so the smart move is matching your own WSPs and testing plan to the specific risks they describe rather than treating the list as a universal mandate.
Pre-examination planning, timelines, and the Entry Packet
Pre-examination planning follows a predictable sequence once you understand the mechanics, and that predictability is what lets a compliance team schedule work and assign owners with confidence. The FDIC's pre-examination planning guidance breaks the process into three phases that examiners and institutions both follow.
- Initial contact and Entry Packet. Typically beginning more than 90 days ahead of the on-site visit, this phase delivers the Entry Packet (IP), which outlines the exam scope, requested materials, and logistics for the pre-exam interview.
- Initial planning. Roughly four to six weeks out, examiners refine scope based on the institution's responses, prior exam history, and the Comprehensive Institution Data Repository (CIDR), a data system that helps tailor document requests to the firm's actual business lines.
- Final planning and off-site work. In the weeks immediately before the visit, examiners complete off-site analysis and finalize the document list, often adjusting based on what the pre-exam interview revealed.
The Entry Packet and the pre-exam interview deserve more attention than most firms give them. The interview is a chance for your compliance officer or designated spokesperson to describe the business in plain terms, which can narrow scope before a single document request arrives. The FDIC's sample pre-examination letter shows the format examiners use and the secure exchange expectations, including EFX and FDICconnect, that institutions should confirm access to well before the packet lands. Treat CIDR fields as a dress rehearsal for the real request list: if your team cannot populate those fields quickly in a drill, the live exam will expose the same gap under worse conditions.
Document and evidence checklist for the CIDR and on-site testing
Most examiner follow-up requests trace back to one problem: documents exist, but nobody can retrieve them in the format or timeframe the examiner expects. Building the checklist below into a standing repository, rather than assembling it reactively, removes that friction.
Priority documents examiners consistently request include:
- Written supervisory procedures (WSPs) and policy manuals, current and with a clear revision history
- Compliance testing reports showing scope, methodology, findings, and remediation status
- Annual review documentation that demonstrates critical evaluation rather than a pro forma sign-off
- Transaction-level samples, including loan files and trade blotters, pulled on a documented sampling basis
- Client or consumer complaint logs with resolution notes
- Marketing and advertising materials reviewed under applicable disclosure rules
- Valuation files and supporting methodology for assets subject to fair value estimates
- Suspicious activity records and related BSA/AML documentation where applicable
The SEC's risk alert on information requests outlines the typical initial document requests investment advisers receive and explains how the Division uses firm and market data to scope those requests, which makes it a useful template for anticipating what your own CIDR response will need to cover. A compliance testing program built around clear documentation makes those reports easier to produce on demand, because the findings and remediation trail already exist in a consistent format rather than scattered across emails and spreadsheets.
Formatting matters as much as content. Tag every document with the control it supports, the date of the finding it relates to, and the remediation action taken, so an examiner can trace an issue from detection through correction without asking a follow-up question. Audit trail discipline, not document volume, is what shortens exam week.
Pro Tip: Name files by control area and date, not by department, so an examiner searching for "custody" or "fee disclosure" finds every relevant document in one pass.
Turning gap analysis into documented evidence
A gap analysis only earns its keep when it produces evidence an examiner can review, not just an internal sense that things look fine. The process below converts a general risk review into the kind of documentation examiners expect to see.
- Map your risk profile to agency priorities. Compare your product lines, client base, and prior exam findings against the current year's SEC and FINRA priorities, then flag where your own exposure is highest.
- Design targeted compliance tests. Define a sampling approach, write a test script that spells out what "pass" and "fail" look like, and record findings in a format consistent with your compliance testing reports.
- Document remediation and follow-up. For every finding, log who owns the fix, the deadline, and the evidence that confirms the fix held, not just that it was assigned.
- Write the annual review to show judgment, not just completion. Note who performed the review, what changed since the prior year, and why specific areas received more scrutiny.
A step-by-step risk assessment built around your actual business model, rather than a generic industry template, tends to surface the gaps examiners care about most because it starts from your own risk concentrations instead of a borrowed checklist.
Pro Tip: Date every remediation note the day the fix is verified, not the day it was assigned, since examiners look for evidence of closure rather than intent.
Running a mock CIDR drill before the examiner arrives
A mock exam is the single best way to find out where your document retrieval process breaks before a real examiner finds it for you. Build the drill around your own business lines rather than a generic template, and run it on a clock.
- Assemble a mock CIDR request list using the Entry Packet format and typical categories from agency guidance.
- Assign an internal examiner-in-charge equivalent, a case manager who tracks document status, and subject matter experts for each risk area.
- Set a response deadline that mirrors the real exam's turnaround expectations, then track where delays happen.
- Rehearse the pre-exam interview with whoever will actually speak to examiners, focusing on plain-language descriptions of the business.
Watch for these common red flags during the drill:
- Documents that exist but take hours to locate because of inconsistent file naming
- Testing reports missing a clear remediation trail
- Spokespeople who cannot describe the business model without relying on jargon
- Gaps between what WSPs say and what staff actually do day to day
Score the drill honestly and treat every delay or missing document as a finding in itself, worth its own remediation note before the real request list arrives.
Study resources, certifications, and training that build readiness
The most reliable study material is the agency's own publications, because they describe exactly what examiners are instructed to test. The FDIC's Entry Packet guidance, the SEC's risk alerts, and FINRA's annual oversight report together describe both the process and the substantive priorities examiners carry into the room.
For individual credentialing, several resources stand out:
- The ABA's Certified Regulatory Compliance Manager (CRCM) program offers an exam structure and reference guide updated annually, widely used as a benchmark credential for compliance officers
- Agency-published typical request lists, used as internal training material so staff recognize document categories before an examiner asks for them
- In-house training tied directly to documentation tasks, so a training session produces a dated record of who was trained on what, itself a piece of exam evidence
Pairing role-based training with a documentation requirement, rather than treating training as a one-way presentation, means each session leaves behind proof of completion that supports your WSPs. A regulatory change management checklist helps keep that training current as new rules, like recent Regulation S-P amendments, work their way into annual review cycles.
How automation speeds examiner responses and reduces follow-up
Centralizing evidence before an exam begins is what separates a smooth production process from a week of scrambling. An automated platform that logs every control action with a timestamp gives examiners a searchable trail instead of a pile of disconnected files, which tends to reduce the number of clarifying requests that extend exam week.
RiskInMind builds toward that outcome with a few specific capabilities:
- SOC 2® aligned controls and bank-grade security claims, relevant when an examiner asks how document integrity is maintained
- A suite of specialized AI agents, including a Compliance First agent, coordinated by a central AI director called Ava
- Demo and resource pages that walk through regulatory reporting workflows for credit unions and community banks
RiskInMind states response times under half a second for real-time processing on its platform pages, a claim worth probing directly in any vendor demo rather than taken as an industry standard. When presenting vendor-generated reports in a CIDR response or pre-exam interview, lead with the audit trail itself: show the examiner how a finding links to its remediation record, since that linkage is usually what shortens the follow-up list.
A compliance leader's short checklist of priorities
The firms that handle exam week well share one habit: they spend their preparation time on the areas most likely to cause client or consumer harm, not on polishing documents that were never going to draw scrutiny. Custody controls, fee calculations, and AML monitoring deserve more hours than a perfectly formatted marketing file review.
The pre-exam interview is your best chance to shape scope, so use it to explain the business in your own words rather than waiting for the examiner to guess. And remediation only counts if the board and senior management can see its status in plain terms, with dates and owners attached, not buried in a testing report nobody above compliance reads.
— Raj
RiskInMind: a demo built around examiner-ready reporting
Readers who recognize a gap between their current document process and what examiners expect have a faster option than rebuilding everything by hand. RiskInMind's product lines, including the Compliance First agent and audit-ready reporting tools, are built to produce the kind of timestamped, traceable evidence this article describes, and the platform's Loan Application workflow shows how document capture and audit trail generation work in practice for lenders.
In a demo, ask specifically about:
- Audit trail granularity, down to who changed what and when
- SOC 2® aligned controls and how document integrity is maintained during secure transfer
- Sample reporting output you could hand an examiner directly
Starter, Professional, and Enterprise plans are available, with details on the pricing page for teams ready to schedule a pilot ahead of their next exam cycle.
This article is general information, not a substitute for advice from a qualified financial advisor. Consult a qualified financial professional about your own circumstances before acting on anything here.
Sources
- Fdic
- FINRA 2026 Annual Regulatory Oversight Report
- Investment Advisers: Assessing Risks, Scoping Examinations, and Requesting Documents (SEC Risk Alert)
- CRCM: Prepare for the exam (ABA)
FAQ
What is a RE5 regulatory examination?
"RE5" is not a standard term used by the SEC, FDIC, or FINRA in their published examination guidance. If you encountered this term in another context, it likely refers to a jurisdiction-specific designation outside the U.S. framework described here, so confirm the source before treating it as a U.S. regulatory category.
Which exam is required to study in the USA?
This depends entirely on your role and sector: investment adviser representatives and broker-dealer representatives typically sit for specific FINRA-administered exams, and compliance managers often pursue the ABA's CRCM certification as a professional credential rather than a licensing requirement. There is no single exam required across all financial roles.
What are regulatory certifications?
Regulatory certifications are professional credentials, like the CRCM, that demonstrate mastery of compliance frameworks and examination processes without being mandatory licenses. They signal to employers and examiners that a professional has studied the agency guidance and testing standards described in programs like the ABA's CRCM prep track.
What are the two types of exams?
In the regulatory compliance context, institutions typically face routine, scheduled examinations following the pre-examination planning process outlined by the FDIC, and targeted or for-cause examinations triggered by specific risk indicators or prior findings. The scope and document requests differ, but both follow a risk-focused approach tailored to the institution's business model.
How far in advance should a firm start exam preparation?
Firms should begin serious preparation as soon as the Entry Packet arrives, typically more than 90 days before the on-site visit according to FDIC pre-examination planning guidance. Ongoing readiness, including ready document repositories and ongoing compliance testing, works best as a continuous practice rather than a pre-exam sprint.