Independent Banker - November 2017 - 72

Risks & Rules
audit program improvement and
learning new job skills. It is common
for students to attribute their course
participation to board or audit
committee encouragement.
Independence from day-to-day
management of audited operations
or regulatory implementation
is essential to the internal audit
function. Employees who oversee
operations and regulatory implementation
can participate in monitoring
and reviews of the areas for which
they have responsibility; however,
the independence adds value and, for
some areas, is legally required.
Because internal auditors must
be at arm's length from day-to-day
operations, a full-time audit position
is ideal. For banks without resources
to support a full-time position,
division of the internal audit
responsibilities is possible; however,
those banks may have limited
staff sizes and fewer experienced,
qualified candidates in house to
perform internal audits.
Auditors should have the
autonomy to plan and conduct the
internal audits, determine the level
of risk for any findings, and report to
the board of directors or the boardappointed
audit committee to ensure
high-level oversight. Administrative
reporting to executive management
is important to communicate findings
and discuss management actions;
however, the auditor should report
to the board or the audit committee
without a filter or inappropriate
influence from bank management.
Outsourced internal audit
Community banks may outsource
the internal audit function to obtain
expertise that is either not feasible or
cost-effective organically, or to build
more robust independence into the
audit function. Community banks
commonly use public accounting
firms and other professional
organizations for outsourced audit
tasks. Outsourcing the internal
audit function can be beneficial for
community banks; however, they
must be contracted with care and
managed diligently.
When used in a prudent manner,
outsourcing part or all of a community
bank's internal audits has
advantages, including:
»Accessing a level of expertise that
ICBA's Auditing Certification program
This program provides community bank internal auditors with the necessary
knowledge and tools to successfully conduct and perform internal
audits in their banks. Instructors take learners through an introductory
module and four critical learning areas:
» Introduction to community
bank auditing
» Operating and compliance
auditing
» Auditing assets and liabilities
» Bank information systems
Each learning area includes
a comprehensive exam. Upon
successful completion of all four
learning areas, each learner is
awarded certification. The program
is worth 50 CPE credits. To
learn more, visit icba.org
72 ICBA IndependentBanker November 2017
is not practical or cost-effective to
maintain in house
» Shifting the fixed cost of employee
compensation and benefits to the
more variable cost of third-party
service providers that can be engaged
to accommodate special projects or
fluctuating needs
»Rotating auditing staff to help
minimize actual or apparent loss
of objectivity.
Outsourcing internal audit also has
disadvantages that community banks
may face, including:
» Third-party providers will not
initially have the familiarity with the
bank's organization, business model
and staff that in-house auditors
would have, which may affect audit
effectiveness or cause frustration for
bank staff.
»Management must ensure the
engagement letter for internal audit
services is comprehensive and communication
with the service provider
is frequent to preclude misunderstandings.
The engagement letter
should be descriptive for the scope of
the contract services to be provided
and protect the bank from risk.
»Management must be diligent
to monitor the execution of the
contract to ensure no internal
audit weaknesses arise due to the
outsourcing arrangement.
Whether internal audits are
conducted in house or by third-party
contractors, they bring
rigor to a community bank's
risk management.
To maximize that return,
community banks must be
sure the right person or
people manage the internal
audit function, and that
they have the full support of
the board, audit committee
and management.
Mary Thorson Wright is
a writer in Virginia.
http://www.qmags.com/clickthrough.asp?url=www.icba.org&id=20402&adid=P72E1
Independent Banker - November 2017

Table of Contents for the Digital Edition of Independent Banker - November 2017
