Your Exam Findings Aren't About the Decision. They're About the Record.

Guest Editorial by Christopher Johnson, Founder of DataVisuals

An examiner sits across from your risk team and asks about a decision made eighteen months ago. She's not asking whether it was right. She can see the outcome. She wants to know how you got there: what prompted it, who owned it, what was considered and rejected.

The room goes quiet. Somebody starts searching email.

Christopher Johnson, Founder of DataVisuals.

That’s the finding. The decision itself was almost certainly defensible. The problem is that nobody can demonstrate the reasoning without rebuilding it from memory, and rebuilding under pressure looks like improvisation even when it isn't.

And the gap is widening. NCUA's 2025 exam flexibility changes moved eligible credit unions over $1 billion to a 12- to 16-month cycle, and qualifying smaller banks have run on an 18-month cycle for years. Longer intervals are a reward for being well run. They also mean more decisions get reviewed from colder memory.

Banks and credit unions are good at documenting outcomes. The exception was approved, the vendor was onboarded, the alert was dispositioned. Those facts live in systems of record, timestamped and auditable. What almost never gets captured is the thinking.

Decision governance is the fix for that. Capture the reasoning when the decision happens, not when someone asks eighteen months later.

Two audiences, one record

Most institutions keep two separate paper trails for the same decisions.

One is built for examiners. It's about process. Was the policy followed, was the authority appropriate, was it applied consistently. It gets assembled in the weeks before an exam, usually by someone who wasn't in the original conversation.

The other is built for the board, and it's about judgment. Did we understand the exposure, who's accountable, what happens if we're wrong. That one gets assembled quarterly and compressed into slides.

Produced separately, months apart, from the same fading recollection, the two drift. And a gap between what the board was told and what the examiner is shown is a harder conversation than any single decision.

A record captured once, at the time, serves both. Tending it as the decision matures (action taken, outcome known, etc.) is the governance.

The five parts of a decision

A decision isn't a single moment. It has an anatomy: signal, owner, decision, action, outcome. Four of those do most of the recordkeeping work. The first one determines whether the other four were worth writing down.

Signal. The thing that forced the question. Every decision starts somewhere — an alert, an audit finding, a regulatory change, a member complaint, a question from the board. The signal is that starting point, captured before hindsight cleans it up. The signal sets what the decision is actually about, and a decision answering the wrong signal can't produce a good outcome no matter how sound the judgment behind it. It's also the element most often left out. A record without it starts mid-sentence.

Owner. A named person, not a committee. Committees approve. A person decides. When a record lists a committee as the owner, the practical answer to "who is accountable" is nobody, and examiners have gotten good at noticing.

Decision. The choice itself, recorded as it looked from inside the room. What was chosen, what was rejected, and what the decision-maker knew at the time. The rejected options matter more than most institutions realize. A record that shows alternatives weighed against stated criteria demonstrates a working process. A record that shows only the option chosen looks the same as a decision made by default. Evidence belongs here too, captured as of that date.

Action. The follow-through. What actually got done, by whom, and when. Decisions and actions diverge more often than anyone likes to admit. The exception gets approved with conditions nobody tracks. The remediation gets scheduled and slips two quarters. A record that stops at the decision can't tell you whether the institution did the thing it decided to do.

Outcome. What happened, recorded when it becomes knowable rather than at the moment of decision. Without the outcome, the record is just paperwork for the examiner. With it, you can answer "did this work?" with something other than an opinion. It's also where the signal comes back around. When outcomes disappoint in volume, the cause is rarely bad judgment applied to good signals. It’s usually good judgment applied to signals that were noisy, late, or aimed at the wrong thing.

Where to start

None of this starts with software. It starts with a habit and a place to put it.

Pick one decision type. Policy exceptions are a good candidate: discrete, consequential, already reviewed, and reliably interesting to examiners. Trying to cover everything at once is how these efforts stall.

Capture at the moment, not at exam time. Writing five short fields while the decision is fresh takes minutes. Reconstructing them later takes days and produces a weaker record. If capture doesn't happen inside the existing approval step, it won't happen.

Start with the signal. If you only add one field, add that one. It costs a sentence, it's almost never recorded today, and it's the only field that lets you look back across a year of decisions and ask whether you were reacting to the right things.

Sample and review quarterly. Pull five records at random and ask whether a stranger could follow them start to finish. If they can't, fix the format.

The decision your examiner asks about next year has probably already been made. It was probably a good one. Whether you can show that depends on what got written down while the reasoning was still fresh.

DataVisuals publishes a free self-assessment that scores an institution against its maturity model. Check it out here: https://datavisuals.com/dgi/self-assessment/start

---

About the author

Christopher Johnson is Founder of DataVisuals, a decision governance company. Its SaaS platform gives banks and credit unions one place to capture risk, compliance and operational decisions as structured, automated, tamper-evident records that hold up in front of both examiners and the board. Christopher is the author of the Decision Governance Maturity Model.