A top-tier digital bank approaching the $10B regulatory threshold had foundational risk elements in place — including a control inventory, RCSA program, issue management processes, and risk appetite constructs, but they were not yet operating as an integrated, risk-informed system. First-line risk ownership was inconsistently defined and executed across functions, governance and escalation protocols varied, and the control environment was overly complex and manual with redundancy in several areas. Limited automation increased operational burden, and issue management tended to address symptoms rather than root causes. Most critically, no standardized testing capability existed to validate that key controls were operating effectively, creating meaningful regulatory and operational exposure as supervisory expectations were set to increase significantly at the $10B threshold.
SolomonEdwards partnered with the bank to stand up its First Line of Defense testing capability end to end.
We provided strategic advisory support to mobilize the testing function. Through working sessions and a review of key artifacts including the ERM Policy, RCSA Program, and Compliance Monitoring and Testing Policy, we delivered a First Line of Defense test plan and methodology, a two-year testing calendar spanning 50+ topics across Digital Banking processes, and a regulatory control inventory mapped to key regulations including Reg E, Reg CC, BSA, NACHA, OFAC, and CIP/KYC. We also developed a Three Lines of Defense RACI framework to clarify accountability across 1A, 1B, second, and third line functions, and provided prioritized recommendations for right-sizing testing, maturing RCSAs, integrating GRC tooling, and aligning with Internal Audit and regulatory exam schedules.
We then embedded a subject matter expert to develop test scripts and reusable workpaper templates anchored to the bank’s key control inventory. For processes where supporting documentation was less mature, we conducted end-to-end walkthroughs; mapping current-state operations, team handoffs, judgment calls, and conditional steps — before developing scripts. Coverage spanned nine priority Digital Banking processes: Money Movement via Telephone, Account Closure (Fraud and Non-Fraud), Statement Generation, Deposit Operations Reconciliation, CRA Disputes including Chex Systems, Savanna Case Management, Customer and Account File Maintenance, and the Contact Center.
The engagement established the bank’s first structured, audit-ready First Line of Defense testing program and laid the foundation for enterprise-wide expansion:
Together, these outcomes moved the bank from reactive control execution to a proactive, risk-informed testing posture — establishing the credibility and infrastructure needed to scale with confidence.
