CFPB Report: 2015-FMIC-C-016 September 10, 2015
The Consumer Financial Protection Bureau (CFPB) publicly discloses certain consumer complaint data through its Consumer Complaint Database, which is available on its website. Our audit objective was to assess the effectiveness of the CFPB's controls over the accuracy and completeness of the Consumer Complaint Database. We evaluated several of the CFPB's management controls relevant to the Consumer Complaint Database. Our audit covered processes performed from January 1, 2014, through June 30, 2014, and included all complaints in the Consumer Complaint Database through June 30, 2014.
The CFPB's Consumer Complaint Database is intended to provide consumers with timely and understandable information to help them make responsible decisions about financial transactions and to ensure that markets for consumer financial products and services operate transparently and efficiently. The database is updated daily with complaint data that are extracted from an internal case management system and then populated to the CFPB's internal Data Team (DT) Complaint Database. A file of public complaint data is then generated and published.
We identified areas in which management controls should be improved to enhance the accuracy and completeness of the Consumer Complaint Database. The Office of Consumer Response (Consumer Response) has implemented controls to monitor the accuracy of complaint data in the internal case management system, which contains all consumer complaints received by the CFPB, but it has not established separate management controls to ensure the accuracy of data extracted from the system and included in the Consumer Complaint Database. We found several noticeable inaccuracies in our analysis of the 254,835 complaints in the Consumer Complaint Database as of June 30, 2014. Although the number of complaints with inaccuracies that we identified was relatively small, enhancing existing controls would help ensure that as the number and types of complaints published increase, overall reliability of the data is maintained.
We also found that Consumer Response does not (1) review all company closing responses, including verifying whether the company-selected response is consistent with the definition, and (2) consistently publish untimely company closing responses in the Consumer Complaint Database. In addition, we found that Consumer Response allows 60 days for consumers to dispute company responses, rather than 30 days as stated in Consumer Response publications. Further, consumers are not consistently offered the opportunity to dispute untimely company responses. Finally, although the Consumer Complaint Database website asserts that complaint data are refreshed daily, we found that Consumer Response did not consistently notify the public when the database was not updated. Consumer Response has resolved the causes for the majority of the daily update failures that we observed, but it has not established procedures to inform the public when complaint data are incomplete or outdated.
Because the DT Complaint Database plays a role in the daily update process, our findings should be considered in conjunction with the security control deficiencies associated with the DT Complaint Database that were identified in OIG Report No. 2015-IT-C-011, Security Control Review of the CFPB's Data Team Complaint Database, July 23, 2015. That report is restricted due to the sensitivity of its content, but a high-level summary is available on our website.
We are making recommendations to improve controls over the accuracy and completeness of the CFPB's Consumer Complaint Database. In its response to our draft report, Consumer Response concurs with our recommendations and indicates that it has already initiated actions to address them. Consumer Response also stated that it implemented a system change to update the process for untimely company responses and related consumer disputes, and it is replacing the DT Complaint Database.
