2025 ACH Audit Workbook

Bradley Company, LLC — South Bend, IN. ODFI: Lake City Bank, ABA 074908594. ACH origination relationship active since 2018.

Payment Collection (tenant/owner rent, association dues), Payroll/Payroll taxes for managed entities, and Owner Distributions (see §17 SOP). Debt Collection, Check Conversion, and Taxes: N/A.

Roles and named contacts populated in the ACH Contacts Matrix (Roles & Responsibilities section of the Policy Manual) and reviewed annually.

No AAP on staff. External AAP support engaged through Lake City Bank's ACH Department for interpretive questions; certification is on the 2025 professional development plan.

Yes — annual mandatory ACH compliance training for all ACH-adjacent staff (Accounting, IT, Audit) delivered via the Lake City Bank ACH training modules and internal policy walkthrough. Completion tracked on the Annual ACH Compliance Calendar.

Yes — the Finance Controller performs an independent same-day review of the ACH balancing worksheet; the reviewer initials and dates the worksheet, which is retained per record-retention policy.

Yes — current-year Nacha Operating Rules & Guidelines subscription maintained by the ACH Compliance Officer and available to all ACH staff via the shared compliance library.

Last audit: 2024 (Bradley Company's first documented ACH compliance audit — see Change Log). All 2024 exceptions are being remediated through the tracked action items in the Change Log. Audit results reported to executive management and retained in the Executive Binder. Proof of completion of the 2025 audit will be provided to Lake City Bank within NACHA's 10-banking-day window.

Yes — 2025 ACH Risk Assessment completed with likelihood, impact, and residual-risk scoring across origination, security, third-party, and operational domains. Weaknesses identified feed the ACH Risk Management Program remediation calendar and the Change Log.

Originator inventory maintained by the ACH Compliance Officer and reviewed quarterly (see Originator Due Diligence Policy). No Nested Third-Party Senders — Bradley Company originates only for its own managed entities.

Approved SEC codes: PPD (credit and debit — payroll and tenant/owner ACH), CCD (credit and debit — corporate and owner distributions), TEL (limited legacy use — see TEL controls). WEB, ARC, POP, BOC, RCK, IAT, and Micro-Entries: not currently used. Same-Day ACH: not currently used.

Onboarding follows the Originator Due Diligence Policy: legal-name / TIN / address verification, OFAC screen, secretary-of-state confirmation, credit/exposure review, and documented approval before first origination. Annual periodic review documented and retained in the Originator file.

Yes — outgoing files reviewed for use of approved SEC codes (see Outbound SEC Code Monitoring Procedure §21, in development). Exposure limits enforced per Originator and per day using the Exposure Limit Methodology.

Inbound data from Originators arrives via a secure/password-protected web-based portal or SFTP; verbal, paper, and unsecured email intake are prohibited. Bradley Company enters instructions; Lake City Bank generates the NACHA-formatted ACH file. Originator cutoff: 2:00 p.m. ET for same-cycle processing.

ACH funding retained. Credit files remain prefunded. Verification of receipt of funds is now performed and documented on the daily origination worksheet prior to release of the file to Lake City Bank.

Lake City Bank ACH Department (as ODFI) and Bradley Company Accounting jointly, with the ACH Compliance Officer responsible for tracking, aging, and Originator notification.

Originators are notified through the secure/password-protected portal or encrypted email (S/MIME or TLS-enforced). Unsecured email notification is prohibited under the new Secure Transmission of NOCs & Return Notifications policy (Policy Manual §19).

Yes — tracked in the ACH Operations log by Originator with monthly return-rate reporting against NACHA thresholds (Unauthorized 0.5%, Administrative 3.0%, Overall 15.0%).

Yes — Reinitiation SOP permits reinitiation for NSF/Uncollected, separately authorized stopped payment, or corrected reason only; separate batch with 'RETRY PYMT' in the Company Entry Description Field is mandatory; within 180 days of original Settlement; maximum of two reinitiations per original Entry.

TLS 1.2+ for all ACH data in transit (SFTP, portal, encrypted email). AES-256 for data at rest within Bradley Company systems. Documented in the Data Security section of the ACH Policy Manual and validated by IT self-assessment.

Role-based access controls enforced through IT identity management; least-privilege model; access reviewed at least annually and upon role change or termination.

Electronic destruction via secure wipe or cryptographic erase per IT destruction schedule; physical media (paper/portable) cross-cut shredded by contracted vendor with certificate of destruction.

2025 — annual self-assessment performed by IT and documented in the Executive Binder; next assessment scheduled on the Annual ACH Compliance Calendar.

Yes — endpoint detection, email threat protection (phishing/BEC), MFA on all ACH-adjacent systems, positive-pay style balance verification on outbound files, and the owner-distribution verbal-verification control (see §17 SOP).

All seven policies exist and are approved: ACH Management (Policy Manual §18, consolidated, in development for Q2 2025), OFAC, BSA/AML, TPS Business Continuity, ACH Risk Management, TPS Audit, TPS Underwriting.

Yes — the consolidated ACH Management Policy (§18) explicitly addresses all five required areas. Verbatim mapping is included as an appendix to the Policy Manual.

Annually. The Annual ACH Policy Review Procedure (Policy Manual §20) codifies the review cadence, evidence retention, and executive sign-off requirement.

Yes — retained and expanded: Owner Distribution SOP, Reinitiation SOP, Reversals SOP, Secure Transmission of NOCs & Return Notifications SOP, Outbound SEC Code Monitoring Procedure.

2024 is the baseline year. The 2024 workbook, this 2025 workbook, and all supporting artifacts are retained in the Executive Binder for the six-year rolling window; the retention log is on the Annual ACH Compliance Calendar.

Yes — the 2025 audit package is retained in the Executive Binder and can be produced to Lake City Bank within the 10-banking-day NACHA window.

N/A — Bradley Company does not have any Nested Third-Party Senders.

All 2024 findings are tracked to closure in the Change Log. Findings and remediation status are reported to executive management and retained in the Executive Binder.

N/A — no Nested Third-Party Senders.

Yes — the Record Retention section of the ACH Policy Manual codifies the six-year retention requirement and the electronic-storage controls.

Encrypted electronic archive with role-based access; retention set to six years unless legal hold applies. Records held beyond six years remain in the same encrypted archive under the same access controls until documented purge.

Originators submit ACH information only via the secure/password-protected portal, SFTP, or TLS-enforced encrypted email. Verbal and unsecured-email intake is prohibited. Security methods are periodically evaluated by IT.

TLS 1.2+ for all transmissions; SFTP over SSH; encrypted email via S/MIME or forced TLS; portal MFA required. Controls documented in the Secure ACH Communications Policy and reviewed annually.

Yes — retained and formalized. The 2025 ACH Risk Assessment adds likelihood/impact/residual-risk scoring and links each risk to a specific control in the Risk Management Program.

Yes — ACH Risk Management Program document adopted and operative, aligned to the 2025 Risk Assessment findings.

Yes — the ACH Risk Management Program requires the ACH Risk Assessment to be performed at minimum annually and prior to any new product offering. Cadence is on the Annual ACH Compliance Calendar.

N/A — no Nested Third-Party Senders.

Yes — all four domains explicitly addressed in the Data Security section of the ACH Policy Manual, with cross-references to IT policy for enterprise controls.

Yes — annual IT self-assessment plus targeted external penetration test scheduled for Q3 2025; results retained in the Executive Binder.

Yes — the updated Origination Agreement includes an Information Security clause obligating the Originator to establish and maintain internal security policies for ACH data. Acknowledgement retained in the Originator file.

Yes — Transmission security requirements are defined in the updated Origination Agreement and reinforced by the Secure ACH Communications Policy. Opt-out is not permitted.

Yes — the updated Origination Agreement template is executed with each Originator prior to first origination and includes the required Rules-compliance and lawful-use clauses. Signed originals retained in the Originator file.

Yes — the updated Origination Agreement is mapped to Appendix C items line-by-line; the mapping is retained as an appendix in the Executive Binder.

Yes — all eight required clauses are present in the updated Origination Agreement.

N/A — no Nested Third-Party Senders. Template clauses are included in the Origination Agreement library for future use if a Nested TPS relationship is added.

Yes — annual review of the Origination Agreement template and all executed agreements is codified in the Annual ACH Policy Review Procedure (§20).

Formal KYC/CDD documented in the Originator Due Diligence Policy: legal-name / TIN / address verification, secretary-of-state confirmation, OFAC screen, beneficial-ownership review, expected-activity profile, and risk rating. Refreshed at annual periodic review.

N/A — no Nested Third-Party Senders. If a Nested TPS relationship is added, the Nested TPS identification and warranty procedures in the Originator Due Diligence Policy will apply.

Yes — the Exposure Limit Methodology documents underwriting inputs, formula, tiering, approval authority, and monitoring frequency.

Established per the Exposure Limit Methodology (volume × ticket × risk multiplier); an exposure limit is set for every active Originator prior to first origination and enforced daily.

Annually and upon material change in Originator profile. 2025 periodic review completed for all active Originators; evidence retained in the Originator file.

Yes — daily origination and Return activity are logged by Originator across Settlement Dates in the ACH Operations log; deviations trigger review.

Yes — Origination Agreement lists approved SEC codes per Originator; outbound files sampled monthly against the approved list per the Outbound SEC Code Monitoring Procedure (§21).

Enforced at file release against the per-Originator limit from the Exposure Limit Methodology. Each Originator is notified in writing of its assigned limit and of the exception process (advance request + management approval).

Credit review is owned by the ACH Compliance Officer with sign-off by the Finance Controller; scope and documentation defined in the Originator Due Diligence Policy.

Return notices from Lake City Bank are received via the ODFI's secure portal. Originators are notified via the secure portal or TLS-enforced encrypted email per the Secure Transmission of NOCs & Return Notifications policy (§19). Unsecured email is prohibited.

Rates calculated monthly by ACH Compliance Officer using the ACH Operations log, with cross-verification against Lake City Bank return monitoring reports. Rates reviewed against NACHA thresholds and reported to management quarterly.

Yes — the updated Origination Agreement addresses optional Prenotification use and requires the Originator to follow Rules if Prenotes are used.

Documented Prenotification SOP: (a) Returned Prenotes notified to the Originator through the secure channel within one Banking Day; (b) subsequent Entries held until the third Banking Day following Settlement; (c) any Return/NOC in response to a Prenote must be remedied and re-documented before the next Entry is released.

Yes — Reinitiation SOP restricts reinitiation to the three permitted scenarios; compliance verified during batch review.

Yes to both — enforced by the Reinitiation SOP with a control on the batch-review checklist.

Yes — mandatory formatting is enforced by the Reinitiation SOP and verified during batch review.

N/A — no Originator currently originates Return Fee Entries. Origination Agreement forbids Return Fee origination unless the Originator provides the required Receiver notice and follows §2.15 formatting; any request triggers ACH Compliance Officer review.

NOCs received from Lake City Bank via secure portal; NOC data pushed to the Originator via the secure portal or TLS-enforced encrypted email within two Banking Days of Settlement. Unsecured email is prohibited (§19 policy).

Yes — the standardized NOC notification template includes every required field per §2.12.1 and Appendix Five; template retained in the Executive Binder.

Formal NOC follow-up SOP: the ACH Compliance Officer tracks each NOC in the Operations log with a due date; the next Entry is blocked at file release until the Originator confirms in writing that the change is made or six Banking Days have elapsed with a documented confirmation.

Yes — authorization-retention verbiage added to the updated Origination Agreement per Art. 2 §2.16.6, and the requirement to provide the Receiver's authorization on request is called out in the Originator onboarding acknowledgement.

Yes — the Authorization Production SOP requires the Originator to provide the authorization within three Banking Days of request; the TPS then delivers to Lake City Bank within the 10-Banking-Day Rules window. Annual test performed with each Originator; results retained.

N/A — ARC and BOC Entries are not originated by Bradley Company or its Originators. Controls will be implemented if ever adopted.

Yes — as part of onboarding and annual periodic review, the ACH Compliance Officer samples authorizations against the SEC code in use and documents the review.

CIP procedures per the Originator Due Diligence Policy: legal-name / TIN / address verification, OFAC screen, secretary-of-state confirmation, and identity verification of authorized signers.

N/A on the Nested TPS component. For direct Originators, due-diligence documentation is retained in the Originator file per the Originator Due Diligence Policy.

Yes — the Reversals SOP defines the permitted scenarios (Erroneous or duplicate Entry/File) and staff are trained annually on the SOP. Owner-distribution Reversals are routed through formal approval channels rather than initiated by the Property Accountant.

Yes — the updated Origination Agreement assigns Reversal creation responsibility (typically Bradley Company as TPS with Originator authorization); verbiage added per Art. 2 §2.9.

Yes — validated during 2025 sample testing; results retained in the Executive Binder.

Yes — the updated Origination Agreement obligates the Originator to notify the Receiver no later than the Settlement Date of the Reversing Entry, with a template notice provided.

Yes — the updated Origination Agreement requires the TEL Originator to either audio-record the Oral Authorization or send written confirmation to the Receiver prior to Settlement. Retention and production timelines are specified.

Yes — the Oral Authorization script is reviewed at onboarding and annually; the reviewed script is retained in the Originator file.

Yes / Yes — training delivered at onboarding and annually. Non-telephone Oral Authorization channels are prohibited unless they meet the Secure ACH Communications Policy requirements (TLS 1.2+ or portal MFA).

TEL Originators are monitored under the standard return-rate and exposure-limit framework, plus a TEL-specific quarterly sample review of authorizations and returns.

OFAC screening against the SDN and consolidated sanctions list performed at Originator onboarding and refreshed at least annually and on Origination Agreement renewal. Screening evidence retained in the Originator file.

Yes — the TPS screens Originators directly. The updated Origination Agreement obligates each Originator to screen its Receivers against OFAC and to warrant that no Receiver is a blocked party.

Yes — Owner Distribution SOP (v. 02/13/2026) adopted. Requires encrypted-email intake of the signed Owner Distribution Form, verbal verification of routing/account numbers with the owner prior to processing, mandatory CCD SEC code for owner distributions, dual approval documented in Microsoft Teams (retained one year), and daily reconciliation. Bradley Company enters instructions only; Lake City Bank generates the NACHA file.

Yes — Section 4.3 of the Owner Distribution SOP requires Accounting to verbally verify routing and account numbers with the owner or authorized representative before entry or update, with the verification documented per internal recordkeeping.

Yes — CCD SEC code is mandatory for owner distributions unless management-approved exception. Every ACH transaction receives two separate approvals documented in Microsoft Teams and retained one year. Errors or exceptions are corrected with the bank within 48 hours; reversals are routed through formal approval channels rather than initiated by the Property Accountant.