Short answer: Reuters reported on October 12, 2026 that Citigroup is working to resolve regulatory demands from 2020 covering risk management and data governance, that filings show about $3.3 billion spent on transformation last year, and, according to a source, that an internal audit in the summer rejected a version of remediation work on data tracing. Most of the detail rests on anonymous sources and Citi has not confirmed it. The governance point stands regardless: a closed action is not evidence that a control is effective, and the gap between the two is where audit committees should look.
This article uses the report as a case for how chief audit executives, CROs and audit committees can tell the difference. It is analysis, not a judgement on Citi.
What Was Reported
According to the Reuters report as republished by Investing.com, the Federal Reserve and the Office of the Comptroller of the Currency (OCC) issued the demands in 2020 after a mistaken $900 million transfer to creditors of a client. Filings show Citi spent $3.3 billion on transformation work last year, and the orders cover risk management, data governance and other issues. A source said an internal audit in the summer rejected a version of the remediation on data tracing, which is the ability to follow where aggregated account data came from.
Watch: $3.3 Billion on Controls, and Gaps Remain
Remediation Complete Is Not Control Effective
Most remediation programmes report progress as the share of actions closed. That measures effort. It says little about whether the underlying control now operates reliably. A data-lineage fix is a good illustration. A team can build the tooling, document the flows and mark the action done, yet an independent reviewer may still be unable to trace a figure from source to report. The audit rejection, if accurate, is not a failure of the process. It is the process working: an independent function declining to accept a fix it cannot validate.
The risk lies where no one is positioned to say no. Closure can be driven by deadlines, by pressure to show progress to a regulator, or by the remediation team grading its own work. We explored a related pattern in why access remediation must be durable to prevent a material weakness and in the assurance delay in internal audit.
Four Tests Before You Call a Finding Closed
The Action Is Complete
The corrective action has been carried out and the owner has confirmed it. This is the stage most trackers record, and it is only the start.
The Evidence Is Sufficient
Evidence is attached, current, complete and tied to the specific observation. For data work, that means showing the lineage from source to report, not a description of the project.
The Control Has Been Independently Retested
Someone independent of the remediation team retests the fix against the original criteria. Retesting is the point at which a fix can be accepted or rejected.
Residual Risk Is Rated and Sustained
The remaining risk is assessed, accepted by a named owner, and monitored so the fix does not decay. A control that worked once may not work next quarter.
Closure should require all four, not the first alone. When retesting rejects a fix, record the rejection and the reason. A rising rejection rate early in a programme is healthy; a rate of zero deserves a question about whether retesting is truly independent. Evidence quality matters too, as covered in evidence intelligence and control validation.
An illustrative example
This is a hypothetical scenario, not a description of any bank. A regional bank must show it can trace risk exposure figures back to source systems. The remediation team documents the flows, implements a lineage tool and closes the action. Internal audit retests by selecting ten reported figures and tracing each to source. Three cannot be traced because a manual spreadsheet step breaks the chain. The closure is rejected, a new action is raised, and the committee sees the rejection in its report with the residual risk rated. Without retesting, the same finding would have been reported as complete.
Building an Audit Governance Layer
The practical response is a technology-led audit governance layer that links every observation to its corrective actions, evidence, retest results and residual risk, with a history of rejected closures and repeat findings. Dashboards for the committee should show retested closures, not just closed ones. Automation can chase owners, validate that evidence matches the requirement and schedule retests, as described in our piece on the audit issue remediation and follow-up agent. Continuous testing can then show whether a fix is holding, as in continuous controls monitoring with agentic AI and the move from sampling to continuous assurance.
Human judgement remains central. People decide whether evidence is sufficient and whether residual risk is acceptable, and every automated step should be logged, as set out in why AI agents need audit trails. For board-level reporting, see the executive layer for risk and audit committee intelligence and the audit committee confidence gap. Banks should also consider vendors in the chain, as in OCC third-party risk management guidance.
Crest.Digital is building Agentic GRC to track observations, corrective actions, evidence, control retesting and residual risk in one governed workflow, alongside its TPRM platform.
Questions for Your Next Audit Committee
- Retesting: What share of closed findings were independently retested?
- Rejections: How many closures were rejected, and why?
- Repeat findings: Which issues have come back after closure?
- Residual risk: Who owns what remains, and how is it monitored?
Frequently Asked Questions
Reuters reported on October 12, 2026, citing a source, that an internal audit in the summer rejected a version of remediation work on data tracing, meaning the ability to trace where aggregated account data originated. It also reported Citi spent $3.3 billion on transformation work last year, per filings. The article does not break down what that spending covered.
No. Most details rest on anonymous sources, and Citi has not confirmed them. A rejected draft can equally show that an independent audit function is doing its job. The lesson here is about process, not a verdict on Citi.
Complete means the planned actions were done. Effective means the control operates as designed, repeatedly, and has been independently tested to show it. Many programmes track the first and assume the second.
Data lineage is the ability to trace data from its origin through every transformation to the report or decision where it is used. Without it, a firm cannot easily show where an aggregated figure came from or whether it is complete and accurate.
Ask for more than the percentage of actions closed. Ask how many closures were independently retested, how many were rejected, how many repeat findings there are, what evidence supports closure, and what residual risk remains. Link progress to the original observation and to the date by which the issue is expected to be resolved.
Sources: Reuters, October 12, 2026 (via Investing.com); PYMNTS, summarising Reuters.