Your Audit Threshold Moved. Your Monitoring Did Not.

When the FDIC finalized its threshold changes in November 2025, the announcement described the effect in a phrase worth reading closely. The rule, it said, provides immediate burden relief to insured depository institutions that are currently subject to part 363 requirements but will no longer be subject to such requirements under the updated thresholds in effect as of January 1, 2026.

Burden relief. Relief from the requirement, which is real and which the industry had asked for over many years. Not relief from the thing the requirement existed to manage. For a number of community banks, an external check that had been part of the annual calendar simply stopped applying. The loan book did not change that week. The core did not get more accurate. The exception queue did not shrink. What changed is how many independent sets of eyes were contractually obliged to look, and that is worth thinking about carefully rather than quickly.

What actually changed

The mechanics are straightforward. The asset threshold at which Part 363 applies at all moved from $500 million to $1 billion. The threshold for the internal control over financial reporting requirement, the one that pulls in a management assessment and an accountant's attestation, moved from $1 billion to $5 billion. The audit committee composition and governance thresholds moved alongside them, and the compensation figure used in assessing whether an outside director counts as independent was raised as well.

The rule also set the thresholds to be indexed for inflation on a recurring basis rather than sitting unchanged for decades, which is the change most likely to matter over time. The 1992 thresholds applied to a materially different slice of the industry than the same numbers applied to in 2025, and indexing is intended to stop that drift from recurring. The text of Part 363 carries the current figures for anyone who needs the specifics.

The practical effect splits into two groups. Institutions between the old and new applicability thresholds are out of mandatory annual audit and reporting. Institutions between the old and new internal control thresholds keep the audit but drop the formal internal control attestation. A $1.4B community bank that spent last year preparing a management assessment and walking an auditor through its control documentation is not doing that this year.

Who examines a community institution anyway

It is worth stating something plainly here, because it is a persistent source of confusion and it shapes the rest of this. Banks at or under $10 billion in assets are examined for consumer compliance by their prudential regulator, the FDIC, the Office of the Comptroller of the Currency, or the Federal Reserve depending on charter. The Consumer Financial Protection Bureau has supervisory authority over larger institutions. Plenty of community bankers assume the CFPB is their examiner and it generally is not.

It is also worth separating two things that often get run together in conversation. A safety and soundness examination and a consumer compliance examination are different exercises with different scopes and different ratings. When people talk about getting ready for the exam, it helps to know which one they mean, because the preparation is not the same.

None of that moved in November. The Part 363 change is about audit and reporting obligations, which sit alongside examination rather than replacing it.

The monitoring half of the picture

Consumer compliance examination of a community institution centers on its compliance management system. Broadly, that breaks into oversight by the board and management on one side, and the compliance program itself on the other, with the program understood to cover written policies and procedures, training, monitoring and audit, and how consumer complaints get handled.

The word that does the work in that list is monitoring, and from our experience it is the one most often misread. Institutions tend to treat it as a question of whether monitoring happened. A monitoring program exists, it runs on a schedule, there is a report. The harder question, and the one that tends to get asked, is whether the monitoring was sufficient for the risks the institution actually carries. Those are different standards and only one of them can be satisfied by activity.

An institution testing a small fraction of a high-volume product is monitoring. Whether it is monitoring sufficiently depends on the product, the volume, the complexity, and what the institution already knows about where its errors cluster. A program sized by available staff hours rather than by risk is difficult to defend on that second question, regardless of how diligently it runs.

Finding it yourself is worth something

There is a second idea embedded in how compliance programs get assessed, and it is the one we would put in front of a board. Corrective action and self-identification carry weight. An institution that finds its own problem, documents it, and fixes it is in a materially different position from one where the same problem surfaces because somebody else pulled the file. The issue is identical. The posture is not, and the posture is part of what gets evaluated.

The uncomfortable corollary is arithmetic. Self-identification is only available inside the population the institution actually looked at. An error sitting in accounts nobody reviewed cannot be self-identified by definition, and it stays unavailable until the day an examiner selects differently than the institution did. We have written separately about why a 10% QC sample is not a quality control program, and this is the part of that argument with the most direct bearing on a rating.

Where credit unions sit

None of the above applies to credit unions, and it is worth being clear about that rather than leaving readers to work it out. Part 363 is an FDIC rule for insured depository institutions. Credit unions operate under 12 CFR Part 715, which sets supervisory committee audit obligations on its own schedule. A federally insured credit union at or above $500 million in assets must obtain an annual financial statement audit performed under generally accepted auditing standards by an independent, state-licensed person. Below that threshold and above $10 million, a supervisory committee audit following the minimum procedures in the rule will satisfy the requirement. Separately, members' accounts must be verified against the credit union's records at least once every two years.

The supervisory committee also carries a standing responsibility that reads very much like the monitoring question above. It must determine whether internal controls are established and effectively maintained to achieve the credit union's financial reporting objectives. That is a judgment about sufficiency, made by people who need something to base it on. So the November change did not touch credit unions. The underlying question, whether internal review is adequate to the risk rather than merely present, sits in both frameworks.

What to do with the relief

The least useful response to an audit requirement going away is to replace it voluntarily with the same audit. If the rule no longer applies, paying for it anyway buys the comfort of the old calendar rather than better information.

The more useful response is to find out what the external check was actually catching, and whether anything internal covers that ground. In most institutions nobody has ever asked that question directly, because the audit was simply a thing that happened every year. A $1.4B community bank that has just dropped its internal control attestation has a reasonable opportunity to ask what that process surfaced over the past three years, and whether its own monitoring would have surfaced the same things.

Have a Problem to Solve?

The institutions that handle this well tend to start narrow. One product, one population, one honest look at how much of it actually gets reviewed today and how that number was arrived at. That is a smaller exercise than a monitoring program overhaul and it usually answers the question. Shore provides automated QC and data quality review for community banks and credit unions, running against the institution's own written procedures with its own team making every judgment call. If the November change has prompted a conversation about what your monitoring covers, reach out to Shore Group and we can compare notes.