Financial Accounting Standards Board

For a more in-depth discussion of these topics, download the comprehensive guide at the bottom of the article. 

Who this applies to: Professionals responsible for credit/risk, accounting, loan operations, and the C-suite at financial institutions.

Financial institutions have devoted significant time and resources to implementing the Current Expected Credit Losses (CECL) methodology. As CECL becomes part of the recurring financial reporting process, attention has shifted from implementation to ongoing governance, monitoring, and independent review. This article briefly summarizes our full guide on the differences between CECL model validation and CECL internal audit.  

What is a CECL model validation?

A CECL model validation is an independent assessment of the methodology and model used to estimate expected credit losses. Its principal objective is to determine whether the model is appropriate for its intended use, supported by sound reasoning, implemented correctly, and producing reasonable and reliable results. For a CECL estimate, validation may address conceptual soundness, model implementation and technical accuracy, and ongoing model performance.

What is a CECL internal audit?

A CECL internal audit evaluates the broader governance, risk management, compliance, and control framework surrounding the allowance estimate. While model validation asks whether the model is sound, internal audit asks whether the institution has an effective process for operating, reviewing, approving, and reporting the estimate. The review may include governance, data and reconciliation controls, access rights, management review controls, reporting, documentation, and remediation.

The most important difference: The questions being answered

The clearest way to distinguish between the two reviews is this: The model validator evaluates the substance of the estimate, while the internal auditor evaluates the process and controls by which the estimate is developed and reported.

Areas of overlap

Model validation and internal audit are distinct, but they are not completely separate. Both may review areas such as data quality and reconciliation, documentation, oversight, model changes, third-party service providers, model monitoring, findings and corrective actions, and policies and procedures. However, the two functions examine these areas through different lenses.

Why one review does not automatically replace the other

Relying only on model validation may leave governance and control risks unaddressed, while relying only on internal audit may miss flaws in the methodology, assumptions, calculations, or model performance. A sound oversight framework considers both model risk and control risk.

A practical illustration

Consider a community bank that applies a qualitative adjustment for worsening economic conditions. A model validation may identify that the adjustment is based on an economic indicator with little demonstrated relationship to the bank’s historical credit losses or creates a risk of double-counting. An internal audit may find that the allowance committee did not review and approve the adjustment as required. The example illustrates how a technically sound model can still have a deficient process, or a well-controlled process can still rely on an unsound model.

Independence and qualifications matter

Both CECL model validation and CECL internal audit should provide objective challenge to the CECL process. Reviewers should be independent from developing, operating, and approving the model, and they should have the appropriate expertise for the review. Institutions may use outside specialists when the necessary expertise or independence is unavailable internally, but management remains responsible for understanding the scope, reviewing the results, and addressing identified issues.

How frequently should each review occur?

Review frequency should be risk-based and reflect the institution’s size, complexity, portfolio composition, methodology, model risk, and prior findings. More frequent or extensive validation may be needed after significant model changes, data-quality issues, recurring findings, portfolio changes, or increased use of management judgment. Internal audit frequency should also reflect risk, and the validation cycle and audit plan should be coordinated to avoid duplication while addressing both model risk and control risk.

Questions management and directors should ask

Management, directors, and audit committee members should evaluate the institution’s CECL oversight framework by asking the right questions across three main areas: model validation, internal audit, and coordination between the two functions. Together, these categories help assess whether model risk and control risk are being addressed without unnecessary duplication.

Download the full guide to CECL model validation and internal audit: Understanding key differences

About the team

For institutions looking for the best value, with the right understanding of scope and combination of skills and expertise, BerryDunn’s dedicated financial services professionals can customize an approach to cover both. Learn more about our services or reach out to us through our Ask the Advisor form. For more insights and expertise, follow and connect with Susan Weber and David Stone on LinkedIn.

Change is inevitable for local governments. Leadership transitions, rapid technological advances, workforce challenges, economic pressures, and shifting community needs can all affect how a locality operates. Yet a strong strategic plan should be able to withstand those changes.

Most local government strategic plans are designed to guide decision-making for three to five years. That time frame provides enough stability to establish meaningful direction while allowing flexibility as conditions change.

The challenge is knowing when change requires an adjustment to the plan, when it calls for a thoughtful refresh, and when it signals the need for an entirely new planning process. The answer depends less on any single event and more on whether the plan continues to reflect the community's priorities and provides a realistic framework for achieving them. Most organizations don't need to choose between rigidly following an outdated plan and starting from scratch. In many cases, the right path lies somewhere in between. To determine whether an organization will refresh an existing plan or create a new one, ongoing evaluation is critical.

Effective strategic planning is an ongoing, multiyear process supported by performance measurement and reporting. The most successful organizations regularly review progress, communicate results, and assess whether their objectives continue to reflect community needs. Effective metrics help leaders understand where progress is being made, where challenges remain, and whether actions are producing meaningful outcomes.

Organizations that regularly discuss progress, celebrate successes, and connect daily work to strategic priorities are more likely to keep their plans relevant and actionable over time. Many strategic plans fail not because they were poorly designed, but because they gradually disappear from regular conversations. With a strategic plan in place, implementation, and regular progress reporting, the question becomes how an organization should respond as circumstances evolve: stay the course, refresh the existing plan, or begin a new planning process.

When to stay the course

Not every change requires a strategic planning reset.

A well-developed strategic plan should be resilient enough to weather organizational and leadership changes. When the vision remains relevant and the community's priorities remain aligned with the plan, staying the course may be the best decision.

Leadership transitions are often among the first events that prompt questions about strategic direction as they may bring fresh perspectives. However, leadership turnover alone does not necessarily mean the community's vision has changed. In many cases, incoming leaders build on foundation of priorities that were developed through strong community and organizational engagement.

The same principle applies to election cycles. Changes within a governing body may introduce new ideas and areas of emphasis, but strategic plans should remain grounded in organization and community priorities. When the long-term aspirations that are actionable, remain unchanged, the existing plan continues to provide valuable guidance.

When an existing plan needs a refresh

While the vision may stay the same, the path to achieving it sometimes needs to change.

Communities experiencing changes in economic conditions, demographic shifts, development patterns, or changing resident expectations often find themselves facing challenges that were not fully anticipated when their plan was created. Leaders should evaluate the community's most pressing needs and determine what remains realistic and achievable. In many of these situations, a refresh of the plan is enough. By updating strategic priorities, performance measures, implementation strategies, and timelines, organizations can help ensure their plans remain relevant while preserving the broader vision that continues to resonate with the community.

When to start over

When leaders find themselves questioning not just how to achieve the vision but whether the vision itself is still relevant, it may be time to start fresh.

A new planning process may be appropriate when community priorities have fundamentally shifted, when major external changes have altered the community's future direction, or when the original vision no longer reflects the realities facing the organization. When the public, leadership, or staff expectations have created an entirely different environment from the one that existed when the plan was first developed, then it can affect an organization's ability to execute its strategy.

Rapid growth, major development, workforce shortages, retention issues, and cultural challenges can limit an organization's ability to carry out its strategy. Increasingly, local governments recognize that organizational health plays a direct role in community outcomes.

External factors can create similar challenges. State mandates, funding uncertainty, economic fluctuations, and policy changes can significantly affect available resources and organizational priorities. These pressures may not warrant a complete restart, but they often require leaders to revisit assumptions and identify new objectives for achieving established goals.

A new strategic planning process allows organizations to revisit foundational questions, gather fresh perspectives from stakeholders, and establish a new roadmap for the future. As the destination changes, revising the map and route may be necessary.

Key takeaways

• A strong strategic plan should provide continuity and direction even when circumstances change.
• Leadership transitions and election cycles do not automatically require a new strategic plan.
• Refresh the plan when the vision remains relevant, but the approach needs to change.
• Consider a new planning process when community priorities or the long-term vision has profoundly changed.
• Regular evaluation, communication, and stakeholder engagement help keep plans relevant and actionable.
• Strategic planning works best when it is treated as ongoing practice rather than a one-time event.

BerryDunn can help

Ultimately, strategic planning is not about producing a document. It is about creating a framework that helps organizations make informed decisions, adapt to change, and move consistently toward a shared vision. The strongest plans provide enough structure to guide decision-making while remaining flexible enough to evolve alongside the communities they serve.

A neutral facilitator can help organizations navigate these discussions. By gathering input, guiding conversations, and building consensus without advancing a particular agenda, a facilitator can help communities create strategic plans that are actionable, reflective of shared priorities, and achievable.

BerryDunn's local government consulting team helps communities develop strategic plans that align stakeholder priorities, create organizational focus, and support long-term success. Whether your organization needs leadership and staff development guidance, a wide-ranging planning process, a strategic plan refresh, organizational development support, or change management assistance, our experienced consultants can help you build a roadmap for the future and turn vision into action. Learn more about our services and team.

Who this applies to: Leaders responsible for finance/accounting, risk management, compliance, operations, IT, and the C-suite at financial institutions.

The FMS East Coast Regional Conference recently brought financial professionals together in Annapolis, Maryland, for three days of learning, discussion, and networking. During the conference, we presented “The Future of Finance: How AI and Tech Can Transform,” a session focused on how artificial intelligence and automation are changing finance, accounting, risk, and operations within financial institutions.  

Our central message was straightforward: Financial institutions will not gain a lasting advantage simply by using AI. As these tools become more widely adopted, differentiation will come from how effectively leaders redesign processes, develop their people, strengthen governance, and improve decision-making.

Finance is moving from reporting to anticipating

Historically, many finance functions have concentrated on periodic reporting, manual reconciliations, historical analysis, and responding to issues after they occur. The emerging model is more continuous and forward-looking, with real-time visibility, automated monitoring, predictive insight, and proactive decision support.  

AI may help financial institutions move routine processing into the background while allowing finance professionals to spend more time interpreting information, advising leadership, and applying judgment. Potential applications include:

• Reconciliations
• Regulatory change monitoring
• Board-package preparation
• Vendor due diligence
• Internal audit planning
• Fraud detection
• Policy summarization
• Credit and liquidity analytics

Importantly, AI is not the same as traditional automation, which generally follows predetermined rules and structured inputs. AI-enabled solutions can work with structured and unstructured information and may generate, predict, summarize, or recommend. Those capabilities create meaningful opportunities, but they also introduce new risks.

Innovation must be matched with governance

Institutions considering an AI use case should ask several questions at the outset:

• Is the use case material?
• Who owns it?
• What data will the tool use?
• Could the output affect customers or members?
• What controls and monitoring will be necessary?
• What vendor risks are involved?

AI may introduce risks involving data quality, inaccurate or fabricated outputs, bias, cybersecurity, privacy, model drift, third-party vendors, overreliance, and governance. Addressing these risks begins with clearly defined ownership, appropriate board visibility, acceptable-use policies, approved tools, data restrictions, training expectations, and a documented risk assessment for each use case.

One of the most important principles from the session was to treat AI-generated outputs as assertions requiring evidence, not as facts. Depending on the use case, controls may include human review, performance testing, segregation of duties, source citations, third-party validation, exception management, and evidence retention.

What the case studies revealed

During the session, attendees worked through scenarios involving AI-assisted reconciliations, AI-generated board reporting, and regulatory change monitoring.

In the reconciliation scenario, an overly broad matching threshold caused the system to clear items incorrectly. In the board-reporting scenario, AI-generated commentary relied on an outdated ALCO assumption. In the regulatory-monitoring scenario, an incomplete source library caused the institution to miss an important update.

Although the scenarios involved different processes, the lessons about what matters were consistent, including:

• Data sources
• Human review
• Evidence
• Ongoing monitoring

The objective is not to slow innovation. It is to make innovation reliable.

Start with the process, not the technology

Institutions do not need to transform everything at once. A practical approach is to:

• Establish governance
• Inventory current use cases
• Assess risks
• Design controls
• Implement and communicate expectations
• Monitor and adapt

Before selecting a tool, leaders should map the existing workflow, identify bottlenecks and manual workarounds, locate sources of error or delay, and clarify ownership. Opportunities can then be prioritized based on business impact, frequency, risk reduction, feasibility, and data availability. A controlled pilot allows the institution to measure results, refine controls, and scale intentionally. 

For many institutions, practical starting points may include reconciliations and exception management, board-package summarization, internal audit risk assessment, regulatory change monitoring, and vendor contract review. More complex applications, including fraud detection, credit risk analytics, CECL forecasting support, liquidity forecasting, and continuous auditing, may provide significant value but require more deliberate governance. Autonomous approvals or high-impact customer decisions without meaningful human review should be approached with particular caution.

The future finance function will not remove people from the process. Instead, technology will perform more routine tasks while people remain responsible for judgment, ownership, challenge, and decision-making. The institutions best positioned for that future will be those that start thoughtfully, build governance into their initiatives, and scale only after they understand both the benefits and the risks.

Key takeaways

• Focus on process improvement, not just technology adoption, because long-term value from AI comes from better workflows, stronger governance, and more informed decision-making.
• Shift finance teams from historical reporting toward real-time insights, predictive analysis, and proactive decision support.
• Establish governance before scaling AI initiatives, including clear ownership, risk assessments, usage policies, data controls, and monitoring.
• Verify AI-generated outputs through human review and supporting evidence, treating AI results as assertions that require validation rather than fact.

About BerryDunn

Have a question about how your financial institution can thoughtfully assess its processes, train team members, create effective internal controls, and improve decision-making to maximize the value of AI? Please don’t hesitate to reach out. Learn more about our team and services.

Who this applies to: Compliance officers, risk managers, revenue cycle, or healthcare administrators in a specialty, primary care, prenatal, or pediatric practice, or Federally Qualified Health Center (FQHC).

Has your medical practice seen an increase in missed appointments? Is your practice seeking to improve attendance for preventive care services? If yes, are you evaluating whether to establish a patient incentive program? Before you proceed, there are federal and state rules that should be analyzed to determine whether to initiate a pilot incentive program.

Patient inducements

A well-designed incentive program must be structured neither to give the appearance of nor be perceived as a patient inducement, based on US Office of the Inspector General (OIG) guidance. The OIG’s nominal value threshold applies exclusively to non-cash items; cash in any form is prohibited, as are general-purpose prepaid cards. Cash equivalents are items that patients can convert to cash and use for any purpose, such as gift cards from “big box” stores. The nominal value (“de minimis”) threshold sets the following limits for gifts:

A. Per-item limit: No single gift can have a retail value above $15. 

B. Annual aggregate limit: The total value of all gifts to the same patient in a calendar year cannot exceed $75. 

The Beneficiary Inducement Prohibition of the Civil Monetary Penalties (CMP) Law 

This law differs from the scope of the federal Anti-Kickback Statute (AKS). The Beneficiary Inducements CMP provides for the imposition of financial penalties (i.e., CMPs) against any person who offers or transfers remuneration to a Medicare or Medicaid program beneficiary if this might influence the beneficiary’s selection of a particular provider or practitioner. Remuneration means anything of value, whether cash, cash equivalents, or below-market-value goods or services.

Violations of the Beneficiary Inducement Prohibition can result in monetary penalties, plus three times the amount claimed from federal programs, and potential exclusion from participation in federal healthcare programs. 

To determine whether a patient incentive program violates the Beneficiary Inducement Prohibition, the National Association for Community Health Centers (NACHC) recommends that an organization ask the following three questions:

1. Is your organization proposing to offer something of value (remuneration) to patients covered by Medicaid, the Children’s Health Insurance Program (CHIP), or Medicare?
2. Is the remuneration likely to influence patients’ decisions to receive goods and services for your organization?
3. Are the goods or services paid for by Medicaid, CHIP, or Medicare?

If the answer to all three questions is yes, then the patient incentive program violates the Beneficiary Inducement Prohibition unless it fits within an existing regulatory exception or safe harbor. 

What is a safe harbor?

The Department of Health and Human Services (HHS) has the authority to protect certain arrangements and payment practices (i.e., safe harbors) under the federal AKS. The safe harbor regulations are updated periodically to reflect changing business practices and technologies in the healthcare industry. These safe harbor provisions have been developed to limit the reach of the statute somewhat by permitting certain non-abusive arrangements (42 CFR 1001.952 Safe Harbors), while encouraging beneficial or innocuous arrangements.

One example is the Preventive Care Services Exception. The regulatory definition of preventive care, for purposes of this exception, means any service that: (1) is a prenatal service or a post-natal well-baby visit or is a specific clinical service described in the current US Preventive Services Task Force’s Guide to Clinical Preventive Services and (2) is reimbursable in whole or in part by a federal healthcare program.  

Clearly define your strategy

• Define the population of patients eligible for the incentive pilot program, purpose, types of eligible visits (i.e., those scheduled based on the treatment plan) and the criteria for earning an incentive. Consider limiting eligibility for participation in an incentive pilot program to established patients, patients at a certain stage of a treatment plan, and/or a particular program.
• Establish a documentation system to track the annual gift disbursement process.
• Refrain from advertising a pilot attendance incentive program in new patient brochures or other marketing collateral to avoid the appearance of improper patient inducement or recruitment.
• Document which safe harbor is relevant to your pilot program. If there are any questions about whether the proposed incentive program qualifies, your organization may seek an advisory opinion from the OIG.
• Confirm that your incentive strategy does not violate any state rules prior to implementation.

Does your state have rules pertaining to incentives, lotteries, and raffles? Depending on your healthcare organization’s corporate status, the term “raffle” may be impermissible. For example, California only permits raffles to be conducted by nonprofit organizations; interested nonprofit organizations must apply for a raffle registration on an annual basis.

BerryDunn can help

Has your healthcare organization evaluated its strategies to promote patients’ attendance for well-child visits or prenatal care or other ambulatory services? If you already have an existing incentive program, have you evaluated it recently to determine whether or not it falls within a safe harbor? Are there any relevant state regulatory requirements that should be evaluated? 

Our healthcare compliance team can help. We incorporate deep, hands-on knowledge with industry best practices to help your organization manage compliance and revenue integrity risks. Learn more about our healthcare compliance consulting team and services.

Additional resources:

• General Questions Regarding Certain Fraud and Abuse Authorities | Office of Inspector General | Government Oversight | U.S. Department of Health and Human Services 
• Federal Register: Medicare and State Health Care Programs: Fraud and Abuse; Revisions to Safe Harbors Under the Anti-Kickback Statute, and Civil Monetary Penalty Rules Regarding Beneficiary Inducements 
• Structuring Patient Incentive Programs to Minimize Risk Under Federal Laws
• https://www.nachc.org/nachc-content/uploads/2024/12/Issue-Brief-Structuring-Patient-Incentive-Programs-to-Minimize-Risk-Under-Federal-Laws
• HHS OIG Fact Sheet on Beneficiary Inducements
• Advisory Opinion Process | Office of Inspector General | Government Oversight | U.S. Department of Health and Human Services

Who this applies to: Chief Financial Officers, Chief Operating Officers, and Chief Compliance Officers at financial institutions.

Financial institutions rely heavily on third-party service providers to deliver critical technology, payment processing, online banking, compliance support, and other essential services. Recognizing the challenges many institutions face in managing these relationships, federal regulators recently issued a joint statement on core service providers and proposed updated third-party risk management guidance.

Focus on risk, not checklists

A central theme of the proposed guidance is that third-party risk management should be tailored to an institution's size, complexity, and risk profile. Regulators emphasize that not all vendor relationships present the same level of risk and that oversight should be tailored to the risks posed by each relationship. Instead, institutions are encouraged to focus resources on relationships that pose the greatest operational, financial, compliance, or customer impact. The regulators also reiterate that the guidance is principles-based rather than prescriptive, and that supervisory findings would be based on unsafe or unsound practices or legal violations rather than deviations from the guidance itself. 

The agencies also emphasize that effective risk management is about managing and understanding risk, not eliminating it entirely. Institutions may accept residual risks when doing so is consistent with their risk appetite and business objectives.

Regulators clarify their approach to core service providers

In a separate joint statement, regulators highlighted concerns about the market dynamics surrounding core service providers. Many financial institutions depend on a small number of large providers and often face challenges obtaining due diligence information, negotiating contracts, monitoring performance, or changing providers. 

To address these concerns, regulators indicated they will consider several factors when determining the level of supervisory attention directed toward core providers, including:

• Transparency in sharing due diligence and performance information 
• Timely disclosure of operational issues and cybersecurity incidents 
• Use of clear service-level agreements 
• Opaque pricing and billing practices 
• Contract provisions that restrict an institution's ability to switch providers or integrate with other vendors 
• Technology investments and operational resilience capabilities 

Accountability for core service providers may increase

Another noteworthy aspect of the regulators' joint statement is the reminder that, under certain circumstances, employees or agents of a core service provider may be considered Institution-Affiliated Parties (IAPs) of an institution. If an individual meets the statutory definition of an IAP, banking regulators may have authority to pursue enforcement actions directly against that individual for misconduct affecting a financial institution. The statement does not create new authority, but it signals regulators' willingness to consider existing enforcement tools when evaluating concerns involving third-party service providers. 

For institutions, this development could ultimately strengthen accountability within the vendor ecosystem. While institutions remain responsible for managing risks associated with outsourced activities, the statement suggests regulators are focused not only on how institutions oversee their core providers, but also on whether core providers and their personnel are meeting their own obligations to operate in a safe, sound, and transparent manner.

What financial institutions should do now

Financial institutions may wish to review their third-party risk management programs with an eye toward ensuring oversight efforts are aligned with actual risk levels. Institutions should also evaluate key core-provider contracts, service-level agreements, incident notification processes, and contingency plans for critical services.

The proposals suggest regulators are seeking to maintain a strong focus on material risks while encouraging a more tailored and efficient approach to third-party risk management. For institutions, that could mean more flexibility in managing lower-risk vendors while placing greater emphasis on understanding and managing relationships with critical service providers.

Bottom line for financial institutions

Regulators appear to be moving toward a more practical, risk-based supervisory framework that recognizes the realities institutions face when working with core providers and other third parties. Institutions should use this as an opportunity to ask whether their current vendor oversight is appropriately scaled to actual risk. In some cases, financial institutions may be applying the same level of documentation, review, and monitoring to lower-risk vendors as they do to critical service providers, creating unnecessary burden without meaningfully reducing risk. Vendors deemed to be low risk likely warrant a scaled-back oversight approach, allowing institutions to focus their oversight activities on vendors that truly represent the highest risk to the institution. Financial institutions that can demonstrate thoughtful risk assessment, proportional oversight, and sound governance should be well positioned under the evolving guidance and should use the guidance as an opportunity to level set their third-party risk management program.

Key takeaways

• Align third-party oversight activities with the actual risk posed by each vendor relationship rather than applying the same level of scrutiny across all providers.
• Focus risk management resources on third parties that present the greatest operational, financial, compliance, or customer impact.
• Evaluate contracts, service-level agreements, incident notification processes, and contingency plans for critical service providers. 
• Recognize that regulators are increasing their focus on core service providers, including transparency, operational resilience, and accountability for misconduct.
• Use the proposed guidance as an opportunity to reassess vendor risk classifications and scale oversight efforts appropriately for lower- and higher-risk relationships.

About BerryDunn

Our dedicated audit, tax, and consulting professionals understand the financial services industry and its challenges and are committed to helping you meet and exceed regulatory requirements. We partner with you to bring tailored approaches to fit your needs and operations and provide guidance on best practices and recommendations that make sense for you. Learn more about our services and team.