The Comptroller's Handbook: What Examiners Read First

The OCC publishes the manual its own examiners work from. Not a summary of it, not guidance about it. The Comptroller’s Handbook is roughly 95 booklets containing the examination objectives, procedures, and internal control questionnaires an examiner uses on site, and every booklet is a free PDF. (Source: Comptroller’s Handbook.)

If you want to know what will be asked about your commercial real estate book, the answer is in a document you can download in thirty seconds. Most bankers have never opened it.

How the Handbook Is Organized

Booklets are grouped into series, and the series tells you what kind of examination the booklet supports.

Safety and soundness is the largest group and covers lending, funding, capital, and operations. Individual booklets go deep on single subjects: commercial real estate lending, agricultural lending, asset-based lending, accounts receivable and inventory financing, allowances for credit losses, concentrations of credit, capital and dividends, asset securitization, bank premises, cash accounts.

Examination process covers how supervision works rather than what is examined. The Bank Supervision Process booklet is the one to read first if you have never read any of them, because it explains the OCC’s supervisory structure, examination authority, the full-scope on-site examination requirement, and how community, midsize, and large banks are supervised differently.

Consumer compliance covers the consumer protection regimes, and a separate securities compliance series covers the government and municipal securities rules. A set of legacy OTS publications is carried alongside these, inherited when the Office of Thrift Supervision was abolished.

Asset management covers fiduciary and trust activities, including collective investment funds and asset management operations and controls.

Each booklet is versioned, with the version and date on the cover. Version 2.0 of the commercial real estate lending booklet is dated March 2022. Versions matter because the OCC revises booklets independently, so two booklets sitting side by side may reflect supervisory thinking a decade apart.

How the OCC Scores Risk

The handbook uses a risk assessment framework that is more granular than CAMELS and worth understanding on its own, because it is the vocabulary examiners use in conversation and in findings.

Examiners assess risk across defined categories, and within each category they judge four things:

• Quantity of risk, the level of exposure, independent of how well it is managed
• Quality of risk management, how well the bank identifies, measures, monitors, and controls that exposure
• Aggregate risk, the combined judgment of the two
• Direction of risk, whether it is increasing, stable, or decreasing over the next twelve months

Direction is the part people underweight. A bank with high but stable and well-managed risk is in a different supervisory position than a bank with moderate and rising risk, and the second one gets more attention. When an examiner says the direction of credit risk is increasing, that is a specific, defined judgment rather than a turn of phrase.

The risk categories the handbook uses across safety and soundness booklets are credit, interest rate, liquidity, operational, compliance, strategic, and price risk. Reputation risk was an eighth category until March 20, 2025, when the OCC issued a bulletin titled “Bank Supervision: Removing References to Reputation Risk” stating that it had commenced removing those references from its Comptroller’s Handbook booklets and guidance issuances. Affected booklets now carry a cover note that references to reputation risk were removed as of that date, with the removals marked by strikethrough in the text. Because the OCC described this as an ongoing process across its publications rather than a single-day change, a given booklet may or may not yet reflect it. (Source: OCC Bulletin 2025-4.)

That change is a clean illustration of why the supervisory guidance channels matter. A bulletin rewrote the risk taxonomy across the handbook. Anyone working from a downloaded copy from 2023 is reading a framework the OCC no longer applies.

How to Read a Booklet

The internal structure repeats across booklets, which makes them faster to use than their length suggests. A typical safety and soundness booklet runs through:

Introduction and overview, which sets out the authority and legal limits governing the activity. For lending booklets this is where the regulatory constraints live, and it is often the most immediately useful section.

Risks associated with the activity, walking each risk category and explaining how it arises in this specific business. The commercial real estate booklet’s credit risk section covers construction issues, market conditions, concentration risk, regulatory changes, interest rates, and environmental liability as distinct sources.

Risk management, describing what the OCC expects in management and board oversight, strategic planning, governance structure, policies, underwriting, and monitoring. This section is written as expectations rather than procedures and is the closest thing to a published standard for the activity.

Examination procedures, the step-by-step work program. This is what the examiner actually executes.

Appendixes, often carrying internal control questionnaires, verification procedures, and worked examples.

For a banker, the risk management section is the one to read. For an analyst, the risks section is more useful, because it enumerates the ways a business line goes wrong in the regulator’s own taxonomy.

Who Is Actually Governed by It

The handbook is the OCC’s, so it directly governs the examination of national banks, federal savings associations, and federal branches and agencies. Which institutions those are depends on charter type.

Its practical reach is wider than its formal scope. State nonmember banks are examined by the FDIC and state member banks by the Federal Reserve, each with their own manuals, and on most subjects the three converge because the underlying interagency guidance is the same. The handbook is frequently the most detailed public statement of an expectation that all three agencies share. A state-chartered bank reading the concentrations booklet is not reading its own regulator’s manual, but it is reading a fair description of what its examiner will care about.

The exception is anywhere the OCC has taken a distinct position, which happens most often on national bank powers and preemption questions that have no state analogue.

What This Is Good For, and What It Is Not

It is good for three things.

Understanding a business line you do not know. The booklets are written to bring an examiner up to speed on an unfamiliar activity, which makes them unusually clear introductions. The agricultural lending and asset-based lending booklets are better primers on those businesses than most commercial material.

Knowing the published standard. When a question is “what does the regulator expect here,” the handbook usually answers it directly and with more specificity than a bulletin.

Reading findings correctly. Supervisory language is precise. Knowing that quantity of risk, quality of risk management, aggregate risk, and direction of risk are four separate judgments makes a criticism legible in a way it otherwise is not.

It is not a compliance checklist, and treating it as one is the failure mode. The handbook repeatedly ties expectations to the size, complexity, and risk profile of the individual bank. A small bank that implements every practice described in a booklet written with larger institutions in view has not thereby satisfied its examiner; it has probably built controls disproportionate to its business, which is its own finding. The same applies in reverse to a CRE concentration that is large in absolute terms but well managed and stable.

It is also not confidential in either direction. The handbook is public; the examination results are not. Reading the procedures tells you what will be asked, and nothing about what any particular bank answered.

---

Frequently Asked Questions

What is the Comptroller’s Handbook?

It is the OCC’s examination manual, published as roughly 95 individual booklets covering safety and soundness, the examination process, consumer compliance, and asset management. Each booklet contains the examination objectives, procedures, and internal control questionnaires that OCC examiners use on site, and all of them are publicly available as free PDFs.

Is the Comptroller’s Handbook publicly available?

Yes. Every booklet is published on the OCC website as a downloadable PDF, and each carries a version number and date on its cover. Booklets are revised independently of one another, so it is worth checking that you are reading the current version rather than a copy downloaded previously.

What does quantity of risk versus quality of risk management mean?

They are two of the four judgments an OCC examiner makes about each risk category. Quantity of risk is the level of exposure independent of controls. Quality of risk management is how well the bank identifies, measures, monitors, and controls that exposure. The two combine into aggregate risk, and examiners separately assess the direction of risk over the next twelve months as increasing, stable, or decreasing.

Did the OCC remove reputation risk from its examination framework?

Yes. On March 20, 2025 the OCC issued Bulletin 2025-4, “Bank Supervision: Removing References to Reputation Risk,” stating that it had commenced removing those references from its Comptroller’s Handbook booklets and guidance issuances. Affected booklets carry a cover note that references were removed as of that date, with the removals marked by strikethrough. The OCC described this as an ongoing process across its publications, so confirm the version you are reading.

Does the Comptroller’s Handbook apply to state-chartered banks?

Not formally. It governs OCC examinations of national banks, federal savings associations, and federal branches and agencies. State nonmember banks are examined by the FDIC and state member banks by the Federal Reserve, each using their own manuals. On most subjects the three converge because the underlying interagency guidance is shared, so the handbook is often the most detailed public description of an expectation all three agencies hold.

---

BankRegReports publishes call report, UBPR, FDIC, Federal Reserve, NCUA, and SEC EDGAR data for every U.S. bank and credit union, with peer benchmarks and quarterly history. Look up a bank