ICS Assists Commercial Bank Restore Quality of Internal Audit Function in Response to Criticism from OCC

I. CHALLENGE:

A financial institution with assets of over $2 billion entered into a formal agreement with the Office of the Comptroller of the Currency (OCC) due to a number of issues related to credit quality, regulatory compliance, business continuity planning, and a weak internal audit function that was being maintained internally. One of the considerations to meet the regulatory requirements was to outsource the function.

The Bank had never outsourced internal audit services before and was nearing a 60-day deadline by the OCC to implement its program for corrective action. The challenge for ICS Risk Advisors (ICS) was to prepare a comprehensive internal audit program that met professional standards and the objectives of the formal agreement between the Bank and the regulator. Quality control of the internal audit function represented a significant challenge to the Bank.

II. FACTORS:

The Bank had to thoroughly examine its requirements for internal audit in a way it had not previously done when the function was handled internally--in the Bank. It needed to find a firm with expertise in auditing the banking sector with significant experience in regulatory compliance, information technology, bank operations, and Sarbanes-Oxley (“SOX”) testing. This needed to be done within a period of 60 days. The Bank issued a Request for Proposal and invited several firms to propose. ICS took up the challenge.

III. SOLUTIONS:

• After its selection by the Audit Co mmittee, ICS immediately began by designing and executing a thorough risk assessment process of the operational, compliance and IT environment. This risk assessment scored areas of the Bank based on discrete risk profiles with an emphasis on accounting and finance, asset liability management, credit quality, regulatory compliance, information technology and operations. Upon completion of the risk assessment, an audit plan was developed to address the identified risk within the Bank.
• After ICS developed the audit plan, it was reviewed with Management and was then approved by the Audit Committee. ICS also coordinated its efforts with the Bank’s external, independent auditing firm.
• ICS used the resources of its ICS Research & Development Center to provide guidance for emerging accounting and regulatory compliance issues relevant to the Bank. The R&D Center provides analysis and implementation guidance to ICS professionals and directly to our clients’ management.
• ICS provided an interdisciplinary team to provide the internal audit services, including specialists in Information Technology, Bank Secrecy Act, ALLL, ALCO, Compliance and Credit Risk.
• As the plan was executed during the year, ICS prepared a Tracking Matrix that set forth the status of all open audit and regulatory findings requiring follow up. This Tracking Matrix was reviewed with management and the Audit Committee on a quarterly basis. The process also verifies that corrective actions have been satisfactorily implemented by management. Quarterly, ICS communicates the list of outstanding items on an ongoing basis. This Tracking Matrix includes comments by ICS, the external auditor and the Regulatory agencies.
• ICS established a solid quality control program over the execution and delivery of its audit reports and work papers.

IV. RESULTS:

The internal audit program ICS established is now in its second year. The audit committee chairman has received positive feedback from the OCC in connection with the significant improvements to the audit risk assessment process, quality of the audit plan, comprehensiveness of the audit reports and over all execution of the function. The Bank’s audit committee chair commented on the work ICS did this way: “The program established by ICS far exceeds our expectations and has been well received by our management, audit committee and regulators.” The Bank’s reputation with its regulators has improved significantly and virtually all of the articles contained in the formal agreement have been lifted regarding internal audit. Management now views ICS as a trusted advisor that brings effective thought leadership to the institution.