What to Expect When Your Bank Reaches $500 Million or $1 Billion in Assets

Good practice starts with educating, and obtaining buy-in, of all stakeholders including individual control operational owners all the way to the board of directors. Setting the tone for the threshold requirements and explaining the importance of the key controls is essential for cooperation and improving results.

While it’s natural to assume your existing internal audit function is already FDICIA-compliant, it may not be true. There are requirements on verifying the entire fiscal year has been included in testing populations for all FDICIA controls, and sample size requirements may differ from your existing internal audit plans. Evaluate time and resources to determine if independent individuals within your institution or your consultants have sufficient skills, training, and budgets to test and report on FDICIA controls.

Watch for instances where the internal audit function (or outsourced internal audit) is actually the control operator. If the function is performing reconciliations, reviewing maintenance changes, assuming responsibility for employee deposit review, etc., then it’s the control. Because it’s not independent of the control, your institution cannot assert on your own work.

Management should determine if there is a clear methodology for risk assessment, sample sizes, frequency of testing, responsibility of testing, documentation, evaluation of control deficiencies, remediation, reporting, and communication with governance and the external audit firm. This methodology should be documented clearly and agreed upon annually with any outsourced parties and your external audit firm.

Your bank may understandably get lost in the documentation of your processes and, if not careful, spend time and resources focused on operational processes instead of ICOFRs. When documenting, take care your controls are defined. Including the who, what, where, why, and how can be very helpful in your control documentation.

Not sufficient: “Operations prints and e-mails Eric a report for his review.”

Sufficient: “Daily, Eric compares report X to the listing Y provided to him by operations and determines if the report totals agree.”

While the internal audit should spend time evaluating operational efficiencies and controls, the FDICIA requirement focuses on ICOFRs. FDICIA compliance is a component, albeit a significant one, of the overall risk management function. There is no special number of controls — each institution is distinct.

Key controls are those that, if they fail, could lead to a material misstatement on your financial statements or regulatory reports. While escheatment of unclaimed cashiers’ checks might be a necessary operational process, the control over this process is usually less than likely to cause a material misstatement. New loan boarding, review of management estimates, wire transfers, and reconciliation of the main correspondent bank are areas much more likely to have controls designed to detect, prevent, or correct potential material misstatements.

Institutions crossing either asset threshold should also evaluate and test key information technology (IT) controls, especially those relating to or impacting the financial reporting process. Give consideration to core processors, investment safekeeping, payroll processing, and accounting systems. Many institutions annually review their IT general controls to gain an overall impression of their systems. This review, while important, might need more extensive testing of certain key elements including, but not limited to, system access, key input and output controls, and user controls required by service organizations to satisfy management’s attestation and the external auditor’s opinion.

Attention should be given to the design and operating effectiveness of key controls. In many instances, sighting evidence of the reviewer’s initials on a reconciliation is not sufficient to conclude the control is designed and operating effectively. It might be necessary to include attributes such as verifying completeness and accuracy of the underlying data, inquiry, or observation of the control operator, and re-performance of the steps within the control in order to determine the control can be relied on.

Management should begin testing early to allow for inevitable control deficiencies. When detected in a timely manner, management can identify the root cause, evaluate the deficiency, correct the underlying control environment, and still have sufficient time during the year to determine if the control then operates effectively. If your bank waits until near the end of the year to perform testing, any control deficiencies noted may have to be reported because management no longer has enough instances of the control to remediate and test to conclude otherwise.

Many internal audit functions have existing internal audit plans testing controls on a rolling basis during the year. For example, your wire transfer audit might be done each year as of June 30, based on the previous 12 months’ wire activity. However, the ICOFR attestation and opinion are as of the end of the institution’s fiscal year. If a key control has not been tested since June, there is generally not enough evidence to say the control is designed and operating effectively as of year-end.

While it’s acceptable to test during the year, we recommend testing a portion of your sample size as of or near year-end. Any samples selected from a prior year’s annual reporting period do not provide evidence of control design and operation for the current year’s attestation and opinion.

While your bank’s controls may be designed properly, there may not be sufficient documentation to show your controls operate effectively. For example, your control operator might only review reports online, which are not retained or are written over by the system. It takes practice and planning to gather and retain documentation of the control’s existence and the underlying information, as well as leave a documentation trail of the review and what it entailed. Each individual control owner should understand what information needs to be retained to evidence the performance of a key control for an effective audit trail.

Next, the internal audit function subsequently testing the control must also retain evidence of this documentation and testing. This step is pivotal, as the external auditor must re-perform a sample of the internal auditor’s work, which generally hinges on the existence of this documentation. Because the external auditor may select another instance of the control’s operation (one the internal auditor did not test), the original documentation must exist. It often takes more than a year for all parties to get a handle on how to document and retain control information, and in the first few years of implementation we typically see many internal control deficiencies caused by absence of documentation

ICOFR reporting doesn’t need to be extensive and cumbersome, but it needs to be timely, accurate, and indicative of a plan to remediate, if necessary. This information should be presented quarterly to management, governance, and the external auditor. This allows for all parties to agree on the evaluation of the deficiency, the impact on the remainder of the year’s testing, and any necessary remediation. Lack of timely reporting increases the potential of the external auditor reporting a significant deficiency or material weakness that might have otherwise been avoided.