After doing our risk assessment, we found that most of our accounts are "covered" accounts and pretty much all of the "Red Flags" are relevant.

On one hand we could see a regulator saying that "your program is too broad, you need to focus on these accounts and these red flags." But on the other hand we could easily see them saying " your program doesn't cover enough."

Do we just stick with our broad program to be safe or try to focus on certain red flags and accounts?

David

Examination procedures should be out in a couple of weeks or so and may help to answer some of your questions.

I would stick with your broad program for now.

Ours includes almost all accounts as covered accounts and includes all but one Red Flag (the one about challenge questions).