How SOP and Policy Management Software Helps Banks Tie Policy Acknowledgments to Performance Records

A bank examiner sits down with the Chief Compliance Officer and the Head of HR. The first question is a familiar one: produce the BSA policy that was in effect on the date of the prior year’s exam, with the list of employees who attested to the version in force on that date. The compliance team pulls the records. The records are good. 

The second question is the one that breaks most banks. Produce the performance review record for any branch manager whose team had a BSA-related issue during the same period, and show how the policy enforcement expectation was reflected in the review note and rating. The HR team pulls the review forms. The forms exist. The link to the policy is not in them. The examiner writes a finding. 

The gap between having a policy and translating policy enforcement into the performance review is where citations land. Most banks run policy management in one system and performance management in another, with no shared identity layer. The link the examiner is asking for sits between 2 systems and gets reconstructed by hand at exam time. 

This article walks bank compliance and HR leaders through the regulatory expectation behind the policy-to-performance link, what an integrated chain looks like, 5 signs the current setup cannot deliver it, and how KC Docs and the Thrive suite hold the chain on one shared data model. 

The Examiner Question 2 Systems Cannot Answer 

A policy in a shared drive isn’t compliance. A bank can publish the policy, post it on the intranet, and email it to staff, and still be unable to prove who signed which version on which date when an examiner asks. 

The harder gap is the one between attestation and behavior. A policy acknowledgment is a record that an employee has read the policy. A performance review is a record of how the employee performed against expectations. The examiner’s question lies at the intersection: did the employee perform in accordance with the policy they acknowledged? That join requires both the attestation and the review to live on the same worker record, tied to the same role, with the same dates and the same policy version. Few banks have that join out of the box. 

3 patterns repeat across exams where the link breaks down. Policy attestations live in the compliance system as a list of acknowledgments without a tie to the role’s review form. Performance reviews live in the HR system as a list of competencies and ratings without a tie to the policy version in force during the cycle. Incidents live in a third system without an automatic link back to either the policy or the review. The examiner reconstructs the link manually, and any inconsistency becomes a finding. 

The Regulators Asking for the Policy-to-Performance Link 

6 U.S. banking regulatory frameworks set the expectation, each in its own terms. 

FFIEC BSA/AML Examination Manual 

Training should cover BSA regulatory requirements, supervisory guidance, and the bank’s internal BSA/AML policies, procedures, and processes. The manual establishes that training must be tailored to each individual’s specific responsibilities, as appropriate. The board of directors and senior management should receive foundational training and be informed of changes and new developments in BSA regulatory requirements. The BSA Compliance Officer and BSA compliance staff should receive periodic training that is relevant and appropriate to remain informed of changes to regulatory requirements and changes to the bank’s risk profile. The documentation expectation runs through the entire section: attendance, content, and tailoring by role are reviewable artifacts. 

OCC Comptroller’s Handbook on Compliance Management Systems 

The OCC expects the board and management, collectively, to be responsible for the bank’s compliance with all applicable laws and regulations. The compliance management system components examiners review include board and management oversight, a compliance program with policies and procedures, monitoring and testing, and a compliance audit function. The board oversight expectation is the thread connecting individual performance to the policy library. 

OCC Heightened Standards (12 CFR Part 30 Appendix D) 

Currently applicable to banks with $50 billion or more in average total consolidated assets (and to smaller banks the OCC designates as highly complex), the Heightened Standards require a written Risk Governance Framework designed by independent risk management and approved by the board of directors. The framework rests on 3 lines of defense: front-line units, independent risk management, and internal audit. Accountability under this framework runs through individual roles, which means the performance review of a front-line manager has to show evidence of risk-governance behavior. The OCC issued a Notice of Proposed Rulemaking on December 23, 2025 (Bulletin 2025-51), proposing to raise this threshold from $50 billion to $700 billion. Until any final rule is published, the $50 billion threshold remains the operative rule. 

2010 Interagency Guidance on Sound Incentive Compensation Policies 

Issued June 21, 2010, by the Federal Reserve, OCC, Federal Deposit Insurance Corporation (FDIC), and Office of Thrift Supervision (OTS), the guidance establishes 3 core principles for incentive compensation arrangements: they should provide employees with incentives that appropriately balance risk and reward, they should be compatible with effective controls and risk management, and they should be supported by strong corporate governance, including active and effective oversight by the board of directors. The implication for banks is direct: the link between policy adherence and compensation is not a nice-to-have but an examination expectation. 

Dodd-Frank Section 956 (May 2024 Reproposal) 

Section 956 of the Dodd-Frank Wall Street Reform and Consumer Protection Act prohibits incentive-based payment arrangements that encourage inappropriate risks at covered financial institutions. The implementing rule was re-proposed on May 6, 2024, by 4 of the 6 agencies required to implement Section 956: the FDIC, OCC, Federal Housing Finance Agency (FHFA), and NCUA. The Federal Reserve and Securities and Exchange Commission (SEC) have not joined this reproposal, which means broker-dealers and investment advisers under SEC jurisdiction are not covered by the current reproposal. The 2024 reproposal contemplates 3 tiered asset thresholds for covered institutions: Level 1 ($250 billion or more), Level 2 ($50 billion to $250 billion), and Level 3 ($1 billion to $50 billion). Without Federal Reserve and SEC participation, the proposed rule may not be finalized in its current form. 

NCUA 12 CFR 748 Appendix A 

For credit unions, the board should approve the credit union’s written information security policy and program and oversee the development, implementation, and maintenance of the program, with specific responsibility assigned for implementation. Staff training is required to implement the program. 

The 6 expectations point in the same direction. Policies must exist in writing. People must be trained against them. Behavior in role must reflect what was trained. And, increasingly, compensation and performance evaluation must reflect risk-management behavior. The bank that cannot show the link breaks the chain at exam time. 

What an Integrated Policy and Performance Chain Looks Like 

A real chain has 5 stages, and each stage produces a record an examiner can read. 

Stage 1: Policy Version 

The SOP or policy is published with a clear version number, an effective date, and a named approver. The approval record sits in the policy management software or system. 

Stage 2: Role-Based Attestation 

Each in-scope employee acknowledges the specific version against their specific role on a specific date. The record holds employee name, role, policy version, date, and evidence (a signature, a click-through, or a recorded acknowledgment). This stage requires acknowledgments with version control and an audit-ready trail of who signed off and when, with deadlines, reminders, and manager escalation until completion. 

Stage 3: Observed Behavior on the Line 

A branch manager either enforces the policy or does not, and that observation is captured somewhere: a supervisor field note, an internal audit finding, a customer complaint review, a BSA/AML monitoring alert. The capture is usually in the incident management system, the audit system, or a manager’s own log. 

Stage 4: Performance Review Note Tied to the Policy 

The annual or cycle review form references the relevant policies the employee is accountable for, with a rating against compliance behavior tied to the role. This is where most banks lose the link, because the review form lives in the HR system and the policy lives elsewhere. 

Stage 5: Reporting Up to the Board 

For banks under the OCC Heightened Standards or under FFIEC BSA/AML oversight, the chain rolls up to a board-reviewed report showing where policies were not enforced, what corrective action was taken, and how the personnel record reflects it. 

A chain that produces all 5 stages out of one platform is what makes the examiner’s 2 questions answerable from one report. A chain stitched together at exam time is what produces the finding. 

5 Signs Your Current Setup Cannot Tie Policy Acknowledgments to Performance 

The 5 signs below show up across bank exams and post-examination remediation projects. Each one is recoverable, and each one is the difference between a clean exam and a written corrective action.

1. Policy Attestations Are Stored as a Folder of Signed PDFs, Not Against a Worker Record With Role and Version 

The audit chain breaks at the role-and-version field. The attestation exists; the link to the role in force on that date does not.

2. Performance Review Forms Never Reference Policy Enforcement

The review covers competencies, goals, ratings, and 360-degree feedback, but the policy library the role is accountable for is not on the form. The examiner asks how the policy expectation was reviewed; the form does not answer.

3. The Compliance Officer Cannot Pull Attestations by Performance-Review Cycle

The compliance system stores attestations by policy version. The HR system stores reviews by cycle. When the question is which managers had open attestation gaps on the BSA policy that took effect July 1 during the Q3 review cycle, the answer requires cross-system reconstruction.

4. An Incident Triggers a Refresher Training Assignment but No Performance Review Note

A near-miss or audit finding fires a refresher training assignment in the learning management system (LMS). The corrective action stops there. The performance management review 6 months later does not reflect the issue, and the chain breaks at the review.

5. 3 Vendors Run Policy, Attestation, and Review Separately, With No Shared Identity Layer

Even if all 3 systems work well in isolation, the single sign-on (SSO) works, and the data exports cleanly, the link between policy acknowledgment and performance review is built by a person joining spreadsheets at exam time. 

How KC Docs and the Thrive Suite Hold the Link on One Data Model 

KC Docs is built to address this gap directly. The solution publishes versioned SOPs, requires sign-off, and proves who acknowledged what. 4 features map to the chain above: versioned policy documents with immutable history, read-and-acknowledge attestations with an audit-ready trail of who signed off and when, automatic re-acknowledgment when a new version publishes, and due dates with reminders and manager escalation. 

The Thrive suite covers performance through 2 solutions. KC Talent uses psychometric, cognitive, and behavioral instruments to score people against role profiles, providing an objective signal on every employee. KC Performance runs review cycles, goals, and gap analysis on KPIs, with 360-degree multi-rater feedback and calibration workflows, and its native LMS integration lets a manager assign a course inside a review and see completion reflected in-line. 

The link between the 2 suites is the shared data model of the workforce development platform. The Comply suite holds KC Docs and KC Safety. The Learn suite holds KC Library, KC LMS, and KC Studio. Because the suites share one worker record, a BSA policy update flows from publication in KC Docs through role-based attestation through the next KC Performance review form without manual reconciliation. Banks that want the policy-attestation-to-performance link on one platform, without a separate governance, risk, and compliance (GRC) contract, get that scope built into the Comply and Thrive suites. 

If you would like to see how your current policy attestation setup and your current performance review process would hold up under an OCC, FFIEC, Federal Reserve, FDIC, or NCUA exam, the KnowledgeCity team can walk through your in-force policy library, your attestation cadence, your review cycle, and your incident records, and show how KC Docs and the Thrive suite would land in your environment. 

Frequently Asked Questions

1. Which bank regulators ask for policy-to-performance linkage in exams?

The expectation runs through 6 regulatory frameworks: the FFIEC BSA/AML Examination Manual (training tailored to responsibilities, board and senior management foundational training, documentation per individual), the OCC Comptroller’s Handbook on Compliance Management Systems (board and management oversight of the compliance program), the OCC Heightened Standards in 12 CFR Part 30 Appendix D (Risk Governance Framework, 3 lines of defense), the 2010 Interagency Guidance on Sound Incentive Compensation Policies issued by the Federal Reserve, OCC, FDIC, and OTS, the May 2024 Dodd-Frank Section 956 reproposal (issued by 4 of 6 agencies: FDIC, OCC, FHFA, NCUA), and NCUA 12 CFR 748 Appendix A for credit unions.

2. How long must banks retain policy acknowledgments?

Federal banking regulators do not set a single retention period for policy acknowledgments, but several adjacent rules establish floors. Bank Secrecy Act records have a 5-year retention floor under 31 CFR 1010.430(d). OCC supervisory documentation expectations typically require retention long enough to support the exam cycle, which means several years. SOX-relevant records have separate retention rules. The operational standard at most banks is to retain policy attestations for at least 5 years, with longer retention for high-risk policies tied to enforcement actions or litigation holds.

3. Can incentive compensation be tied to compliance behavior?

Yes, and increasingly the regulators expect it. The 2010 Interagency Guidance on Sound Incentive Compensation Policies establishes 3 core principles, including that incentive compensation should be compatible with effective controls and risk management. The May 2024 Dodd-Frank Section 956 reproposal limits incentive-based payment arrangements that encourage inappropriate risks at covered financial institutions, with tiered thresholds at Level 1 ($250 billion or more), Level 2 ($50 billion to $250 billion), and Level 3 ($1 billion to $50 billion). Banks subject to the OCC Heightened Standards must show accountability for risk-governance behavior, which often runs through compensation as well as performance review.

4. How does KnowledgeCity tie policy acknowledgments to performance reviews?

KC Docs publishes versioned policies, routes each document to the roles that must acknowledge it, and keeps a read-and-acknowledge attestation trail with due dates, reminders, and manager escalation. KC Performance runs review cycles on the same platform, with goals, 360-degree multi-rater feedback, and a native LMS integration that shows assigned training and completion inside the review. Because both run on one shared worker record, the compliance officer can pull attestations by role, version, and review cycle, and the review form can reflect the policies the role is accountable for, which is the join a bank examiner asks for.