Almost 18 months after it gave ASIC an enforceable undertaking over responsible lending failures, consumer leasing company Thorn Australia still has work to do to fix its credit assessment process, dispute resolution policies and risk management.ASIC has put two reports on its website prepared by Deloitte, the independent expert appointed to report on the progress of the EU. Both reports are dated May 7.Deloitte identified several areas for "enhancement" of Thorn's processes. It found:•    Thorn's approach to conducting credit hindsight reviews was not risk-based;•    in managing disputes, Thorn provided the outcome of complaints in writing only, when it should use electronic means as well as post;•    the company's risk management strategy, which was based on the "three lines of defence model" was not being managed in a way that reflected the model; and•    Thorn's suitability assessment policies were loose, in some cases approving credit where verified expenses exceeded verified income.Deloitte found "an improvement in the way Thorn was documenting further inquiries in accordance with its policies, [but] further improvement was still required."It needed better documentation in its lease assessment system. It needed better policies for dealing with gamblers. And it needed to develop better business rules in dealing with "buy now pay later" liabilities.In January last year, Thorn Australia, a subsidiary of Thorn Group, agreed to refund or write off A$6.1 million of default fees and charges relating to 60,000 leases, after it was found to have contravened responsible lending rules.The company also agreed to refund $13.8 million of excess lease payments.ASIC said that between 2012 and 2015 Thorn had a flawed credit assessment process in place. It failed to make reasonable inquiries about each consumer's financial situation and failed to take reasonable steps to verify each customer's financial situation.In May the Federal Court ordered Thorn to pay a $2 million fine.