You just received your information request letter (IRL). Or maybe you haven’t received it yet, but you know an exam is coming in two months. Either way, the clock is running.
In the most prepared banks and fintechs, this moment is routine. The exam management function kicks in, artifacts are gathered, and the team shifts into execution mode. For everyone else, it can feel like a scramble.
The good news: even if your program isn’t fully mature, you can do meaningful work in 60 days. This playbook breaks the pre-exam window into four phases, with specific actions for each, so you know exactly what to prioritize and when.
Phase 1: Days 60 to 45 — Assess and Organize
This is your planning phase. Before you start pulling documents, step back and understand what you’re walking into.
Anticipate the exam scope.
What type of exam is this? Consumer compliance? BSA/AML? Safety and soundness? The scope determines what data, accounts, and documents you need to prepare. Sharing materials outside of scope can create unnecessary risk. Examiners share information with each other, and anything you put in front of them can be memorialized in your audit trail.
Review prior exam and audit reports.
Pull your most recent exam report, internal audit findings, and any outstanding corrective action items. Examiners will reference these. If you had findings last time, they will check whether you addressed them. If remediation is incomplete, that’s the first thing to surface now, not during the exam.
Identify known compliance gaps.
Be honest about where your program has weaknesses. Review your risk assessment, issue logs, and complaint trends. The goal is to know your vulnerabilities before the examiner does.
Pull your audit calendar.
Check for conflicts. Are there other audits, internal testing cycles, or bank partner assessments happening in the same window? If so, plan around them. Resource conflicts during exam prep create avoidable problems.
Run a mock exam.
If time allows, run an internal mock exam or readiness drill. Pull a sample of accounts, gather the artifacts, and walk through the process as if the exam were happening today. This is where you’ll find the gaps you didn’t know you had.
Key outputs for Phase 1:
- Exam scope summary and anticipated focus areas
- Prior findings tracker with remediation status
- Known gaps and risk areas documented
- Conflict check against other audit/testing activities
Phase 2: Days 45 to 30 — Gather and Validate
This is your heaviest execution phase. You’re assembling the evidence package and validating that it holds up.
Compile your compliance artifacts.
Start gathering the core documents examiners will request:
- Current policies and procedures (confirm none have expired)
- Monitoring reports and testing results for the review period
- Issue logs and corrective action documentation
- Complaint logs with root cause analysis and resolution evidence
- Training records, including completion rates and effectiveness measures
- Board and committee meeting minutes related to compliance oversight
- Risk assessment documentation
Validate your policies.
Are your policies current? Do they reflect what you actually do? A policy that’s technically correct but not followed is an operational failure, and examiners will catch the gap. If a policy is outdated or misaligned with practice, update it now and document the revision with version control.
Organize evidence for easy access.
Centralize your artifacts in a format that examiners can navigate. This could be an indexed PDF book, a secure shared drive, or access to your issue management and complaint management systems. The format matters less than the organization. If an examiner has to ask you three times for the same document, you’re losing credibility.
Sanitize and scope your data.
Make sure you’re only sharing what’s relevant to the exam scope. Redact sensitive information that falls outside the review. If the exam covers consumer compliance, don’t hand over BSA investigation files unless they’re requested. Over-sharing can create new lines of inquiry you didn’t intend.
Start closing open items.
If you have corrective actions from prior exams or audits that are still in progress, accelerate them. Completed remediation looks significantly better than a promise to remediate. If you can close it before the exam starts, do it.
Key outputs for Phase 2:
- Complete artifact package organized by category
- Policy review and update log
- Centralized, examiner-ready evidence repository
- Remediation tracker with updated statuses
Phase 3: Days 30 to 7 — Prepare Your People
Your documents are ready. Now make sure your people are.
Confirm your primary and backup points of contact.
Every exam needs a lead, the person who assembles artifacts, manages the examiner relationship, and coordinates across teams. Identify a backup in case of illness, travel, or unexpected conflicts. No vacations during exam week.
Brief your subject matter experts.
Examiners want to speak with the people who do the work, not general counsel, not a spokesperson. Identify who owns each process area (complaints, monitoring, training, vendor management) and make sure they’re prepared to speak to it. If someone critical is unavailable during the exam window, flag it now and plan around it.
Train your team on exam conduct.
This doesn’t need to be formal, but everyone who may interact with an examiner should understand a few principles:
- Answer the question that was asked, completely and accurately. Don’t volunteer information beyond the scope of the question.
- If you don’t know the answer, say so and commit to following up. Don’t guess.
- Be respectful and professional. Treat examiners the way you’d want to be treated.
- Never misrepresent your program. Substance beats form every time.
Prepare an opening presentation.
Put together a brief deck for the examiner covering:
- Summary of your program since the last exam
- Key actions taken on prior findings
- Areas of focus or improvement
- Any concerns you’d like the examiner to weigh in on
This sets the tone. It shows preparation, transparency, and a willingness to engage constructively.
Run a clean desk exercise.
If examiners will be onsite, conduct a clean desk enforcement activity the week before. Sensitive documents, sticky notes with passwords, client information on whiteboards: all of it needs to be secured. This is a small detail that can create a big problem if overlooked.
Key outputs for Phase 3:
- Primary and backup POC confirmed and briefed
- SME availability confirmed for exam window
- Exam conduct briefing completed
- Opening presentation drafted
- Clean desk activity scheduled (if onsite)
Phase 4: Exam Week — Execute and Document
The exam is here. Your job now is to be responsive, organized, and transparent.
Respond to requests promptly.
When the examiner asks for something, deliver it quickly and accurately. Delays erode confidence. If you need time to pull a document, communicate a realistic timeline and follow through.
Set up regular check-ins.
Establish a cadence with the examiner, daily or every other day, to discuss progress, address questions, and surface any issues early. The goal is to avoid surprises on both sides.
Ask for real-time feedback.
Request that the examiner flag issues as they’re identified rather than saving them for the final report. This gives you the opportunity to begin remediation immediately. In some cases, demonstrating that you’ve already started addressing a finding can influence how it’s characterized in the report.
Document everything.
Keep a running log of every request, every document provided, every conversation, and every commitment made. This protects you during report review and creates a record for future exams.
Key outputs for Phase 4:
- Request/response tracker updated in real time
- Check-in cadence established and maintained
- Running log of examiner interactions and commitments
After the Exam: Don’t Stop at the Draft Report
Many teams treat the draft report as the finish line. It’s not.
Review the draft report carefully.
Make sure the language is accurate. The final report will live in your regulatory record permanently. If you go public, it resurfaces. If you have another exam, the next examiner will use it to scope their review. Inaccurate language in a final report can compound over time.
Respond to every finding.
For each finding, observation, or recommendation, document a formal response. Include:
- Whether you agree or respectfully disagree, with supporting evidence
- What remediation actions have been taken (ideally already completed)
- Timeline for any remaining corrective action
- Evidence of completed remediation, where applicable
A response that includes completed remediation is far stronger than a promise to fix something later. This is where proactive teams separate themselves.
Don’t ignore observations and recommendations.
Even if a recommendation doesn’t require formal remediation, document your position. Future staff, future examiners, and future auditors will look for a response. If there’s no documented rationale for why you chose not to act on a recommendation, it can be reinterpreted as a gap.
Feed findings back into your program.
Every exam finding should flow into your issue management process, your risk assessment, and, where relevant, your training and policy updates. The exam isn’t a standalone event. It’s an input into your ongoing compliance operating system.
A Note for Startups and Lean Teams
If you’re a one-person compliance department, a founder managing compliance alongside everything else, or a team using fractional support to get through an exam, the 60-day timeline still applies. You just scale it to your resources.
The principles don’t change:
- Know your scope.
- Gather your evidence early.
- Prepare your people.
- Be transparent and honest.
- Document everything.
You don’t need a perfect program. You need a defensible one. Meet the task where you’re at, and build from there.
The Bottom Line
Audit readiness is not something you flip on 60 days before an exam. It’s the way you operate every day. But when the exam window opens, having a structured playbook helps you move from preparation to execution without scrambling.
The teams that perform best in exams aren’t the ones with the biggest teams or budgets. They’re the ones who start early, organize their evidence, prepare their people, and engage examiners with transparency and professionalism.
