A complaint dashboard can be accurate and still give a Chief Compliance Officer an incomplete view. Its totals describe what entered the system. They say little about concerns recorded as inquiries, lost during a digital submission, or retained by a service provider. Can the institution trace a consumer’s concern from initial contact to the person responsible for acting on it?
The CFPB’s Compliance Management Review procedures examine whether complaints and inquiries are recorded across channels, investigated reasonably, and used to identify deficiencies and corrective action. These are examination expectations. Applicable laws establish specific duties, while consent orders impose remedies on the named firms. That distinction matters when deciding which lessons to apply elsewhere.
The OCC’s July 2022 Bank of America order required an expanded complaint definition and improvements across identification, tracking, escalation, resolution and quality assurance (Article VI). The CFPB’s October 2024 Apple order described a different intake failure: tens of thousands of qualifying billing-error notices were not forwarded to Goldman Sachs when consumers did not complete an additional form. Neither company investigated those notices. Requiring the extra form prevented those notices from reaching the bank. The CFPB terminated Apple’s order on September 22, 2025 and waived alleged non-compliance with it. This is a historical example, not an active obligation on Apple. Read the order status.
For a CCO, the useful test is to follow several actual customer journeys. Does a concern remain visible when it moves between a call center, an app and a partner? Can an “inquiry” contain facts that trigger a legal obligation? Who checks that records sent by a partner were received and assigned? A common reporting category helps aggregation, but cannot establish that the underlying population is complete.
Timing deserves the same attention. The date of the customer’s experience, first notice to the institution, entry into a case system and receipt by Compliance may differ. A late data feed can make an old problem appear new. Conversely, stable monthly totals can conceal growing delays. Which date drives the applicable deadline, and can the institution explain the time spent between each step?
Broad intake does not mean every contact needs the same investigation. Review effort can reflect the allegation, potential harm and applicable duties. But prioritization needs a visible record of what was deferred or excluded, why, and how that decision is checked. A low complaint count is reassuring only when access to the process and completeness of the data have also been tested. What evidence would convince the CCO that fewer complaints reflect fewer problems rather than greater difficulty reporting them?