What a collections firm's audit file should contain

An audit file is not a folder you assemble when a review is announced. It is the by-product of working the account correctly, kept in a shape a stranger can read. Per account, an examiner or a bank reviewer expects to see what arrived at placement and from whom; what you sent and on what date; what the consumer told you and what you did about it; what evidence you held before you filed and who authorised the filing; what the court did; and how the money moved. The CFPB's examination procedures name the categories a reviewer will ask for — consumer files including original loan documents and payment records, court documents, third-party contracts and oversight materials, and complaints. The mapping that matters is chronological, because almost every artifact on this list derives its value from being dated at the moment the decision was made rather than reconstructed afterwards.

What a reviewer actually asks for

Start from the published request list rather than from what your last reviewer happened to want. The CFPB's Debt Collection Examination Procedures direct examiners to obtain, among other things, monitoring procedures, compensation policies, relevant computer program and system details, "[c]onsumer files, including original loan documents, and payment records systems," audit and compliance reports with management responses, training programs and materials, scripts, "[t]hird-party contracts and oversight materials, including monitoring reports and findings," written correspondence with consumers, court documents, and complaints from the Bureau's own channel and elsewhere.

Bank oversight teams copy this list, because it is the list their examiner will apply to them. That gives you a useful planning assumption: the request will not be exotic, and the difficulty will not be finding any single item. It will be producing all of them for the same account, in a consistent order, for a sample the reviewer picks rather than one you pick.

The procedures also say plainly that examiners perform transaction testing using sampling. That has a design consequence. A file assembled by hand looks excellent for the twenty accounts someone had time to assemble and unremarkable for the rest, and sampling is specifically good at finding the difference.

Placement: what arrived, and what you checked before working it

The first block of the audit file describes the account as you received it and what you did to it before doing anything to the consumer. The artifacts are: the placement record itself, with the date, the client, the portfolio and the data fields as supplied; the media that came with it, or the record of what was requested and what was not supplied; the chain-of-title documents where the client is a debt buyer; and the results of your initial scrubs, each with the date it ran and the source it used.

The scrub results are the part firms most often keep only as a current status rather than as a dated event. "Not in bankruptcy" is a state; "queried the national index on this date, no case found, queried again on this date" is evidence. The same is true for deceased, for military status, for represented-by-counsel, and for the limitations determination.

Address and telephone data belong here too, with provenance. Regulation F confines a collection action to the judicial district where the consumer signed the contract or resides at commencement, and it treats a time before 8:00 a.m. or after 9:00 p.m. at the consumer's location as inconvenient. Both are decisions made from data whose source and date the file should record — which append supplied the address, which field established the time zone.

Pre-suit: the evidence, and the decision to file

This block is the one a bank reviewer reads most carefully, because it is where the firm exercises judgment on the client's behalf and in the client's name. It holds the documentation supporting the claim, the limitations analysis, the venue analysis, and the record of attorney review.

The documentation itself is covered in more detail on our guide to the documents needed to file suit. What matters for the audit file is the ordering: the evidence has to be datable to before the filing. A production that shows account-level documentation obtained three weeks after the complaint was served answers a different question than the one the reviewer asked, and it answers it badly.

Attorney review needs its own artifact. The Pressler consent order made this concrete by requiring, for those respondents, that the attorney whose name appears on the complaint have logged into the consumer's account on a system that creates an electronic record of the access, and have reviewed the account-level documentation and the transfer documents. Whatever your own standard, the file should contain something that a person other than the reviewing attorney can point to: a timestamped certification, a system event, a signed review sheet. An attorney's recollection is not an artifact.

Filing through judgment: what the public record proves

Once the suit is filed, part of your audit file is written by the court, and that part is cheap for anyone to check — which is exactly why reviewers start there.

Keep the filed complaint with its exhibits as filed, the return of service, the affidavits as submitted, the military-service affidavit or its equivalent, any additional notices the local rules require, the judgment, and the post-judgment enforcement papers. Where a court's own gate produced a delay — a rejected filing, a clerk's correction queue, an additional mailing that had to be completed before default could be entered — keep the record of that too, because the interval between filing and judgment is a thing reviewers ask about and a good answer is usually procedural.

The examination procedures direct examiners in this area to review "court documents filed by or on behalf of the entity, steps to enforce court judgments such as garnishment of consumer wages and attachment of consumer bank accounts, policies of the debt owner and state or local laws governing these practices, consumer complaints, consumer files, and other relevant materials." Note that the debt owner's own policies are on the list. If your client's placement standards are stricter than the law, a reviewer will test you against the standards, not only against the rule.

After: disputes, complaints, payments and the close

The back half of the file records what the consumer said and what you did in response, and it is where lag is most visible. For each dispute: the date it arrived, the channel, what it disputed, the date collection stopped, the date verification went out, and what went to the consumer reporting agencies in the meantime. For each complaint, however it arrived: the same shape, plus the outcome and any remediation.

Payment records need to reconcile in both directions — what the consumer paid, what was applied, what was remitted to the client and when, and what was held. Trust accounting is a separate obligation with its own rules in every state, but from the audit file's point of view the requirement is simply that the account ledger and the client ledger agree and that the dates are real.

Closure is an artifact too. Whether the file closed on payment, settlement, judgment, recall, or a decision not to pursue, the reason should be recorded at the time and the account should be traceable afterwards. Recalls are the ones that go missing: an account pulled back by the client mid-litigation leaves a dismissal in the public record and often nothing at all in the firm's file explaining it.

Retention, and who else has to be able to read it

Regulation F sets the floor. A debt collector must retain records that are evidence of compliance or noncompliance with the FDCPA and the rule from the date collection activity begins on a debt until three years after the last collection activity on that debt, and call recordings, if you make them, for three years from the date of the call. That clock is keyed to the debt, not to a fiscal year, which means a purge job driven by calendar age is the wrong shape.

Retention is a floor, not a plan. Judgments are enforceable for far longer than three years in most states, and a garnishment challenged in year eight is defended from the original file. Your client's contract may also require longer, and where the two disagree the contract governs your obligation to the client whatever the rule permits.

The last requirement is legibility to an outsider. Bank contracts commonly provide for "[t]he banking organization's ability to access its data in an appropriate and timely manner" and for its data and supporting documentation to be shareable with regulators as part of the supervisory process. That is the practical test of an audit file, and it is stricter than it sounds: not whether the firm can reconstruct the account, but whether someone who has never seen your system can follow the account from placement to close and see, at each step, what was known and when.

This is an informational reference, not legal advice, and using it creates no attorney-client relationship. Limitations periods turn on facts this page cannot know — which state's law governs, the contract type, when the claim accrued, and whether anything tolled or revived it. Confirm against the primary source and your own counsel before acting.