# Can a bank hide their own internal audit if they found a mistake in how they handle credit?

- Jurisdiction: United States
- Practice area: Consumer Law
- Published: 2026-11-10
- Last updated: 2026-11-10
- Canonical: https://lawasked.com/us/consumer-law/can-bank-hide-their-own-internal-audit-if

## Question

I work as a compliance officer for a medium-sized regional bank in Ohio. Over the last six months, our management team decided to run a series of internal self-tests to see if our loan officers were following all the federal rules regarding credit disclosures. During a review completed last Tuesday, we discovered that for about 200 different customers, we accidentally failed to provide the correct paperwork regarding their interest rates and fees. As soon as we found this error, our legal department instructed us to start a formal program to fix every single one of those accounts and notify the affected people. Now, a government regulator is starting an investigation into our lending practices, and they are demanding to see the full report from that internal self-test we just finished. My boss is telling me that we don't have to hand over that specific report because we found the mistake ourselves and are already working to fix it. I have already checked our internal files, but I am not sure if the law actually protects us from having to show that specific document to investigators if we are already in the process of correcting the error. Can the government force us to turn over our private internal audit results if we are already fixing the problem?

## Summary

Usually, yes, the government can force you to turn over the report. While certain self-tests are privileged, that protection may not apply if the regulator is investigating compliance with credit laws.

## Analysis

Under federal law, your bank might be able to claim 'privilege' over the self-test report. Privilege is a legal rule that keeps certain documents private from being used in court or by government agencies. 

According to 15 U.S.C. § 1691c–1, a report is considered privileged if the creditor "conducts, or authorizes an independent third party to conduct, a self-test... in order to determine the level or effectiveness of compliance" [1] and "has identified any possible violation... and has taken, or is taking, appropriate corrective action" [1]. Since your legal department has already started a program to fix the 200 accounts and notify customers, you appear to meet these two conditions. If these conditions are met, the report "may not be obtained or used by any applicant, department, or agency in any... examination or investigation relating to compliance with this subchapter" [1].

However, there are major exceptions. The privilege is lost if the bank "voluntarily releases or discloses all, or any part, of the report or results to the applicant, department, or agency" [1]. Additionally, the government can still seek the report if it is being used "in conjunction with an adjudication or admission of a violation... for the sole purpose of determining an appropriate penalty or remedy" [1].

Because the regulator is currently investigating your lending practices, they may challenge your claim of privilege. If they do, the bank may have to go to a court to get a judge to decide if the report is actually protected [1]. It is also possible that the specific type of credit error you found falls under different regulations that do not offer this specific protection. State laws in Ohio may also impose different requirements regarding document production during investigations.

## Statutory citations

- Consumer Credit Protection Act (Truth in Lending, Fair Credit Reporting, Fair Debt Collection), 15 U.S.C. § 1691c–1 - Incentives for self-testing and self-correction [in force] (https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title15-section1691c–1)
  > A report or result of a self-test... shall be considered to be privileged... if a creditor... has identified any possible violation of this subchapter by the creditor and has taken, or is taking, appropriate corrective action to address any such possible violation.
- Consumer Credit Protection Act (Truth in Lending, Fair Credit Reporting, Fair Debt Collection), 15 U.S.C. § 1691c–1 - Incentives for self-testing and self-correction [in force] (https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title15-section1691c–1)
  > any report or results of that self-test... may not be obtained or used by any applicant, department, or agency in any... examination or investigation relating to compliance with this subchapter.

---
General information only, not legal advice. See https://lawasked.com/disclaimer