# Law firm audit readiness checklist

> A self-assessment a collections law firm can run before a bank's oversight review, grouped by domain, with the regulatory basis for each item.

- Source: https://ottoforfirms.com/bank-audits/law-firm-audit-readiness-checklist/
- Publisher: Otto — https://ottoforfirms.com
- Updated: 2026-07-26
- Status: in attorney review. Served noindex and excluded from the sitemap; do not cite as settled.

[Bank audits](https://ottoforfirms.com/bank-audits/)

A self-assessment a collections law firm can run before a bank's oversight review, grouped by domain, with the regulatory basis for each item.

Work through it as you are. The boxes are real form controls on a page with no JavaScript: ticking one changes nothing beyond this browser tab, nothing is saved, and nothing is sent anywhere — there is no form here to submit. Print it if it is easier to work on paper; the print layout drops everything but the checklist.

## Call compliance

1. [ ] You can pull, for any account on any date, a log showing how many collection calls you placed to that person about that debt in the preceding seven days — and your dialer refuses the eighth. — Basis: 12 CFR 1006.14(b)(2)(i)(A) presumes compliance where a debt collector places no more than seven calls to a particular person about a particular debt within seven consecutive days; § 1006.14(b)(2)(ii) presumes a violation of FDCPA § 806(5) above that. Calls excluded from the count are listed at § 1006.14(b)(3). Regulation F took effect November 30, 2021 (85 FR 76734, Nov. 30, 2020). (https://www.law.cornell.edu/cfr/text/12/1006.14)
2. [ ] After a telephone conversation with a person about a particular debt, your system suppresses further calls to that person about that debt for seven consecutive days, counting the conversation date as day one. — Basis: 12 CFR 1006.14(b)(2)(i)(B), which states expressly that "[t]he date of the telephone conversation is the first day of the seven-consecutive-day period." This is a separate presumption from the seven-calls-in-seven-days cap, and a firm can satisfy one while breaching the other. (https://www.law.cornell.edu/cfr/text/12/1006.14)
3. [ ] Your calling windows are enforced against the consumer's local time rather than your office's, and for any given phone number you can show which time-zone data your system relied on. — Basis: 12 CFR 1006.6(b)(1)(i): absent the collector's knowledge of circumstances to the contrary, a time before 8:00 a.m. or after 9:00 p.m. local time at the consumer's location is inconvenient. Area code and ZIP code can disagree; the evidence an examiner asks for is which one your system used. (https://www.law.cornell.edu/cfr/text/12/1006.6)
4. [ ] When you learn a consumer is represented by counsel on a debt and you know or can readily ascertain that attorney's name and address, direct consumer contact is blocked across every channel, and the file shows the date the block went on. — Basis: 12 CFR 1006.6(b)(2), subject only to the exceptions at (b)(2)(i)-(ii) — the attorney fails to respond within a reasonable period of time, or consents to direct communication. Contacts made to acquire location information are separately restricted once you know of the attorney, under § 1006.10(b)(5). (https://www.law.cornell.edu/cfr/text/12/1006.6)
5. [ ] Every electronic communication or attempt to communicate — email, text, or any other electronic medium — carries a clear and conspicuous opt-out method, and opting out costs the consumer nothing and asks for nothing beyond their preference and the address or number being opted out. — Basis: 12 CFR 1006.6(e), which requires the statement in each such communication and forbids requiring, directly or indirectly, any fee or any information other than the opt-out preference and the address or number concerned. (https://www.law.cornell.edu/cfr/text/12/1006.6)
6. [ ] When someone asks you not to use a particular medium, that medium is shut off for them, and the only thing that goes out through it afterward is the single confirmation or single reply the rule permits. — Basis: 12 CFR 1006.14(h)(1), with the three narrow exceptions at (h)(2): an electronic opt-out confirmation containing nothing but the confirmation, one response through a medium the person themselves used to initiate contact, and communications otherwise required by applicable law. (https://www.law.cornell.edu/cfr/text/12/1006.14)

## Dispute handling

7. [ ] For every account you can show either that validation information was given orally in the initial communication or that a validation notice was sent in or within five days of it — and that the notice stated the specific calendar date you treat as the end of the validation period. — Basis: 12 CFR 1006.34(a)(1). The validation period ends 30 days after the consumer receives or is assumed to receive the information, and receipt may be assumed no earlier than five days (excluding Saturdays, Sundays, and legal public holidays under 5 U.S.C. 6103(a)) after you provide it — § 1006.34(b)(5). The end date must appear in the notice — § 1006.34(c)(3)(i)-(iii). (https://www.law.cornell.edu/cfr/text/12/1006.34)
8. [ ] A written dispute received within the validation period stops collection on the debt or the disputed portion until you have actually sent verification or a copy of a judgment — and you can produce both the date collection stopped and the date the response went out. — Basis: 12 CFR 1006.38(d)(2)(i); a dispute you reasonably determine to be duplicative may instead be answered under (d)(2)(ii) with a brief statement of reasons and a reference to the earlier response. The response must be sent in the manner required by § 1006.42. (https://www.law.cornell.edu/cfr/text/12/1006.38)
9. [ ] A written request for the original creditor's name and address received within the validation period stops collection until you send it — or until you reasonably determine the original and current creditor are the same, tell the consumer that, and point them back to the validation information. — Basis: 12 CFR 1006.38(c)(1)-(2). This is a separate trigger from a dispute, with its own cease-collection consequence; firms that route both through one queue often satisfy one and miss the other. (https://www.law.cornell.edu/cfr/text/12/1006.38)
10. [ ] Direct disputes about information you furnish to credit bureaus get a documented reasonable investigation, completed and reported back to the consumer within the FCRA § 611(a)(1) period, and you can produce the investigation file for a named account. — Basis: 12 CFR 1022.43(a) and (e), subject to the exceptions at (b) and the address and content conditions at (c)-(d). Written policies and procedures on the accuracy and integrity of furnished information are separately required by 12 CFR 1022.42(a), reviewed and updated periodically under (c). (https://www.law.cornell.edu/cfr/text/12/1022.43)
11. [ ] Once a consumer has told you specific information is disputed, nothing goes to a consumer reporting agency without the dispute notation attached. — Basis: 15 U.S.C. 1681s-2(a)(3). Regulation F reaches the same conduct from the other direction: 12 CFR 1006.18(c)(2) treats the failure to communicate that a disputed debt is disputed as a false or misleading means. Separately, § 1006.30(a)(1) bars furnishing at all until you have spoken to the consumer or mailed or emailed them and waited a reasonable period for an undeliverability notice. (https://www.law.cornell.edu/uscode/text/15/1681s-2)

## Documentation before suit

12. [ ] Before you threaten or file a collection suit, the file holds original account-level documentation showing at least the consumer's name, the last four digits of the account number at charge-off, and the claimed amount excluding post-charge-off payments — plus the contractual terms and conditions if you are suing on a contract theory. — Basis: CFPB Consent Order, In re Pressler & Pressler, LLP, Sheldon H. Pressler, and Gerard J. Felt, File No. 2016-CFPB-0009 (Apr. 25, 2016), ¶ 36(a). The Bureau found that filing on client summary data alone was an unfair means under FDCPA § 808 (15 U.S.C. 1692f) and an unsubstantiated representation under § 807(10). The order binds only those respondents, but the CFPB's Debt Collection Examination Procedures (March 2022) apply the same substantiation theory to litigation practices generally. (https://files.consumerfinance.gov/f/documents/201604_cfpb_consent-order-pressler-pressler-llp-sheldon-h-pressler-and-gerard-j-felt.pdf)
13. [ ] For debt-buyer clients, you hold a chronological list of every prior owner with the date of each transfer back to the creditor at charge-off, plus a certified or otherwise properly authenticated bill of sale for each transfer that specifically references the debt you are suing on. — Basis: Pressler & Pressler consent order ¶ 36(b)-(c) (Apr. 25, 2016). The order requires that each document evidencing transfer of ownership "include a specific reference to the particular Debt being collected upon" — a generic portfolio-level bill of sale does not satisfy it. (https://files.consumerfinance.gov/f/documents/201604_cfpb_consent-order-pressler-pressler-llp-sheldon-h-pressler-and-gerard-j-felt.pdf)
14. [ ] An attorney whose name appears on the complaint has personally opened the file in a way that leaves an electronic record, has reviewed the account documentation and the chain of title, and has certified in writing or in your system that the filing is proper — all before the suit goes out. — Basis: Pressler consent order ¶ 37(a)-(d) and (h) (Apr. 25, 2016). The Bureau's findings recorded signing attorneys spending "less than a few minutes, sometimes less than 30 seconds" per case (¶ 15). Independently, representing that a communication is from an attorney where no attorney was meaningfully involved is a false representation under 15 U.S.C. 1692e(3) and 12 CFR 1006.18(b)(1)(iii). (https://files.consumerfinance.gov/f/documents/201604_cfpb_consent-order-pressler-pressler-llp-sheldon-h-pressler-and-gerard-j-felt.pdf)
15. [ ] An attorney has confirmed, and the file records, that the statute of limitations had not run before either the suit or the threat of suit went out. — Basis: 12 CFR 1006.26(b) flatly prohibits bringing or threatening to bring a legal action to collect a time-barred debt, with no knowledge element on its face (bankruptcy proofs of claim excepted). Pressler ¶ 37(e) requires attorney confirmation before filing. Note that the CFPB's advisory opinion on time-barred debt, 88 FR 26475 (May 1, 2023), was withdrawn effective May 12, 2025 (90 FR 20084) — the regulation itself is unchanged. (https://www.law.cornell.edu/cfr/text/12/1006.26)
16. [ ] You screen for bankruptcy by a method you can demonstrate is reliable and current, both before filing and again before taking judgment or executing on one. — Basis: 11 U.S.C. 524(a)(2) makes a discharge an injunction against the commencement or continuation of an action to collect a discharged debt as a personal liability of the debtor. 12 CFR 1006.30(b)(1) separately bars selling, transferring for consideration, or placing for collection a debt you know or should know has been paid, settled, or discharged in bankruptcy. Pressler ¶ 37(f) required confirmation "based upon methods or means proven to be historically reliable and accurate." (https://www.law.cornell.edu/uscode/text/11/524)
17. [ ] Every default judgment application in your files is accompanied by an affidavit stating whether the defendant is in military service, or stating that you were unable to determine it. — Basis: Servicemembers Civil Relief Act, 50 U.S.C. 3931(b)(1). Where the defendant appears to be in military service, § 3931(b)(2) bars entry of judgment until the court appoints counsel. This is one of the few pre-suit controls whose evidence sits in the public court file, so it is cheap for an examiner or a bank reviewer to sample. (https://www.law.cornell.edu/uscode/text/50/3931)
18. [ ] No affidavit leaves your firm unless the affiant actually had the personal knowledge it claims, it was executed in the presence of the notary whose seal it bears, and the documents attached relate to the specific consumer being sued. — Basis: Pressler consent order ¶ 39(a)-(f) (Apr. 25, 2016), which permanently enjoined submitting affidavits misrepresenting personal knowledge, notarization, the affiant's review of original account-level documentation, or the relationship of attached documents to the consumer sued, and required attorney certification before submission. The parallel ethical duty is candor toward the tribunal — e.g., Ohio Prof.Cond.R. 3.3(a)(1) and (a)(3); every state has an analogue. (https://files.consumerfinance.gov/f/documents/201604_cfpb_consent-order-pressler-pressler-llp-sheldon-h-pressler-and-gerard-j-felt.pdf)

## Trust accounting

19. [ ] Client and third-party funds sit in a separately designated trust or IOLTA account, no firm money is in it beyond what is needed to pay or obtain a waiver of bank service charges, and the account records reach back the full period your state requires. — Basis: Cited here to Ohio Prof.Cond.R. 1.15(a) and (b) as a verified, representative state adoption of the ABA Model Rule 1.15 pattern: (a) requires funds held separate in an account designated "client trust account," "IOLTA account," or a clearly identifiable fiduciary title, with records preserved seven years after termination of the representation or disbursement, whichever comes first; (b) limits the lawyer's own funds to bank service charges. Your own state's rule controls and the retention period varies — verify it rather than assuming seven years. (https://www.supremecourt.ohio.gov/docs/LegalResources/Rules/ProfConduct/ProfConductRules.pdf)
20. [ ] You keep a ledger for each client showing the date, amount and source of every receipt and the date, amount, payee and purpose of every disbursement with a running balance — and a monthly reconciliation of those ledgers against the bank records is actually performed and retained. — Basis: Ohio Prof.Cond.R. 1.15(a)(2) (per-client records including current balance), (a)(3) (per-account records), (a)(4) (retain bank statements, deposit slips, cancelled checks), and (a)(5), which requires the lawyer to "perform and retain a monthly reconciliation." The retained reconciliation is the document a disciplinary auditor or bank reviewer asks for first, because its absence cannot be cured after the fact. (https://www.supremecourt.ohio.gov/docs/LegalResources/Rules/ProfConduct/ProfConductRules.pdf)
21. [ ] Collections owed to a creditor client are remitted promptly with notice, and where you and a client or third party disagree over a portion, the disputed portion stays in trust while the undisputed portion is distributed. — Basis: Ohio Prof.Cond.R. 1.15(d) (prompt notification on receipt, prompt delivery of funds the client or third person is entitled to receive, and a full accounting on request) and 1.15(e) (hold the property until the dispute is resolved; promptly distribute all portions not in dispute). Remittance timing is also usually a contractual term in the bank or debt-buyer placement agreement, so the same failure shows up in two places. (https://www.supremecourt.ohio.gov/docs/LegalResources/Rules/ProfConduct/ProfConductRules.pdf)

## Retention

22. [ ] For a debt you stopped working three years ago you can still produce the records evidencing compliance or noncompliance with the FDCPA and Regulation F, and your destruction schedule keys off the date of last collection activity on that debt rather than a calendar year. — Basis: 12 CFR 1006.100(a): retain from the date you begin collection activity on a debt until three years after your last collection activity on that debt. The CFPB's Debt Collection Examination Procedures (March 2022) note, citing Comment 100(a)-2, that there is no requirement to create additional records for the sole purpose of evidencing compliance — the duty is to keep what you have, not to manufacture more. (https://www.law.cornell.edu/cfr/text/12/1006.100)
23. [ ] If you record collection calls, every recording is retained three years from the date of that call, and you can retrieve a specific call by account and date without a vendor ticket. — Basis: 12 CFR 1006.100(b), a standalone rule with its own clock — three years from the date of the call, not from last collection activity. The CFPB's Debt Collection Examination Procedures (March 2022) direct examiners to "[d]etermine whether the entity retains any recordings of telephone calls in connection with the collection of a debt for three years after the date of the call." (https://www.law.cornell.edu/cfr/text/12/1006.100)
24. [ ] Where you have replaced paper with scans, the electronic record accurately reflects the original and stays accessible and accurately reproducible, for everyone entitled to it, across the whole retention period. — Basis: E-SIGN Act, 15 U.S.C. 7001(d)(1)(A)-(B). Relatedly, validation notices and dispute or original-creditor responses sent electronically must satisfy E-SIGN § 101(c) consent, per 12 CFR 1006.42(b), and all required disclosures must be sent in a manner reasonably expected to give actual notice and in a form the consumer can keep and access later, per § 1006.42(a)(1). (https://www.law.cornell.edu/uscode/text/15/7001)

## Access controls

25. [ ] Access to consumer files is authenticated and limited to individuals who need it, privileged duties are segregated, staff with access to consumer information have had background checks, and consumer data is encrypted both in transit and at rest. — Basis: Interagency Guidelines Establishing Information Security Standards, 12 CFR part 30, App. B, § III.C.1.a (access controls that authenticate and permit access only to authorized individuals), § III.C.1.c (encryption in transit and in storage on networks or systems to which unauthorized individuals may have access), and § III.C.1.e (dual control, segregation of duties, employee background checks). These bind the bank directly; § III.D requires the bank to impose equivalent measures on service providers by contract and to monitor them. (https://www.ecfr.gov/current/title-12/chapter-I/part-30)
26. [ ] Paper and electronic media holding consumer report information are destroyed so the information cannot practicably be read or reconstructed — and where a vendor does the destruction, you did diligence on them and you monitor their compliance. — Basis: FTC Disposal Rule, 16 CFR 682.3(a) (reasonable measures to protect against unauthorized access in connection with disposal) and (b)(1)-(3) (burning, pulverizing or shredding; destruction or erasure of electronic media; contracting with a record-destruction firm after due diligence and monitoring compliance). Issued at 69 FR 68697 (Nov. 24, 2004) under FACTA § 216. It reaches any person under FTC jurisdiction that maintains consumer information for a business purpose. (https://www.law.cornell.edu/cfr/text/16/682.3)
27. [ ] You hold a current named point of contact at each bank client for security incidents, and your incident runbook requires notifying them as soon as possible once an incident has materially disrupted covered services for four or more hours. — Basis: 12 CFR 53.4(a), the OCC's bank service provider notification requirement, adopted at 86 FR 66442 (Nov. 23, 2021). Where the bank has not supplied a designated contact, § 53.4(a)(2) requires notice to its CEO and CIO. Scheduled maintenance or updates previously communicated are excluded by § 53.4(b). Parallel rules apply to service providers of Federal Reserve and FDIC-supervised banks; the banking organization's own 36-hour clock to its regulator runs under § 53.3. (https://www.law.cornell.edu/cfr/text/12/53.4)
28. [ ] Your bank engagement agreements give the bank a right to audit you and your relevant subcontractors, specify the reports you owe and how often (SOC or equivalent), and require you to notify the bank of compliance lapses, enforcement actions, and any use of subcontractors. — Basis: Interagency Guidance on Third-Party Relationships: Risk Management, 88 FR 37920 (June 9, 2023), issued jointly by the OCC, Federal Reserve Board, and FDIC. See the contract discussion on the right to audit and require remediation (periodic independent audits of the third party and its relevant subcontractors; SOC and comparable reports) and on notification to the banking organization of compliance lapses, enforcement actions, regulatory proceedings, and subcontractor use. The guidance is principles-based and binds banking organizations, not your firm directly — it reaches you through the contract, which is why the engagement letter is the evidence. (https://www.federalregister.gov/documents/2023/06/09/2023-12340/interagency-guidance-on-third-party-relationships-risk-management)

---

This is an informational reference, not legal advice, and using it creates no attorney-client relationship. Limitations periods turn on facts this page cannot know — which state's law governs, the contract type, when the claim accrued, and whether anything tolled or revived it. Confirm against the primary source and your own counsel before acting.