Internal Control: Supplement on Internal Auditing

1 Internal Control: Supplement on Internal AuditingEffective date May 2006 Section information in the first part of this section isreprinted from a publication of the BankAdministration Institute (BAI), entitled State-ment of Principle and standards for InternalAuditing in the Banking Industry. The secondpart of this section reproduces appendixes A andB from the February 9, 2006, InteragencyAdvisory on the Unsafe and Unsound Use ofLimitation of Liability Provisions in ExternalAudit Engagement Letters. (See section this manual.)A STATEMENT OF PRINCIPLECONCERNING INTERNALAUDITING IN THE BANKINGINDUSTRYI nternal Auditing is that management functionwhich independently evaluates the adequacy,effectiveness and efficiency of the systems ofcontrol within an organization and the quality ofongoing systems of control comprise the plan oforganization and all methods and measuresdesigned to: Provide reasonable assurance that assets aresafeguarded, information (financial and other)is timely and reliable, and errors and irregulari-ties are discovered and corrected promptly.

2 Promote operational efficiency. Encourage compliance with managerial poli-cies, laws, regulations, and sound operations comprise all activitiesinvolved in the conduct of the organization Internal auditor is accountable to theboard of directors and executive accountability precludes the auditor fromorganizational relationships that may conflictwith the need for OF INTERNALAUDITING IN THE BANKINGINDUSTRYO rganization Standards1. The organization shall have an Internal auditfunction responsible for evaluating the ad-equacy, effectiveness and efficiency of itssystems of control and the quality of The organization shall maintain an environ-ment within which the auditor has thefreedom to The organization shall allocate sufficientresources to the audit function to enable it toconform to the standards of Internal The organization shall require managementto respond formally to adverse audit findingsand to take appropriate corrective The organization s systems of control shallinclude measurement of audit effectivenessand Standards1.

3 An Internal auditor shall have adequatetechnical training and An Internal auditor shall maintain a suf-ficiently independent state of mind to clearlydemonstrate objectivity in matters affectingaudit An Internal auditor shall respect the confi-dentiality of information acquired whileperforming the audit An Internal auditor shall only engage inactivities that do not conflict with the interestsof the An Internal auditor shall adhere to conductthat enhances the professional stature ofinternal An Internal auditor shall exercise due profes-sional care in the performance of all dutiesand in the fulfillment of all Standards1. The Internal auditor shall prepare a formalaudit plan that covers all significant organi-zational activities over an appropriate cycleof The audit plan shall include an evaluation ofcontrols within new systems and significantmodifications to existing systems before theybecome Audit procedures shall provide sufficient andCommercial Bank Examination ManualMay 2006 Page 1competent evidential matter to support con-clusions regarding the adequacy.

4 Effective-ness and efficiency of the systems of controland the quality of ongoing The organization of the audit function andrelated administrative practice shall providefor the proper supervision of persons perform-ing audits and for the proper review of Standards1. The auditor shall prepare a formal report onthe scope and results of each audit Each audit report shall contain an opinion onthe adequacy, effectiveness and efficiency ofthe systems of control and the quality ofongoing operations; the degree of compli-ance with previously evaluated systems ofcontrol; or an explanation of why an opinioncannot be expressed. When an adverseopinion is expressed, the report shall containa statement about the exposures that mayexist in the absence of corrective The auditor shall communicate auditfindingsin a timely manner to the managers respon-sible for corrective At least once each year the auditor shallmake a summary report of audit activities tothe board of directors and executive manage-ment.

5 The report shall include an opinion onthe overall condition of the organization scontrols and following comments are presented in orderto promote the acceptance of the Statement ofPrinciple and standards for Internal Auditing inthe Banking Industry, to provide a context forthe application of its concepts and to enhancethe understanding of Internal Auditing . It isintended that the statement and the commentarywill serve as a basis for the continuing advance-ment of the profession sinfluence and Auditing as a DisciplineInternal Auditing is developing a broader perspec-tive by recognizing that all operations areproperly subject to control and within the scopeof Auditing . The Internal auditor s concern forcontrol should extend beyond accounting mat-ters.

6 This broader concept better serves theboard of directors and executive management towhom the Internal auditor is accountable. BankAdministration Institute believes the systems ofcontrol and ongoing operations, as definedherein, provide a preferred perspective fordiscussing Internal Auditing within the frame-work of the Auditing discipline taken as a of ControlThe systems of control exist to assure theachievement of intended results, to promoteoperating efficiency and to encourage compli-ance with policies and other established con-straints. Although Internal auditors have adefinite interest in verifying the results of busi-ness activity, their primary concern must be thecontinuing effectiveness of the systems of controlthat influence business results.

7 The importantqualities that must be evaluated are adequacy,effectiveness and evaluating adequacy, the auditor analyzessystems to determine that they include designfeatures proper to the circumstances and reason-ably sufficient to effect control . The evaluationof adequacy begins with the comparison of what should be to what is. Initial auditsand audits of proposed procedures or organiza-tion structures focus primarily on the adequacyof evaluating effectiveness, the auditor mea-sures the degree of compliance with controlfeatures and the extent to which complianceserves the intended purposes. The question thatmust be answered is: Do the controls work? In evaluating efficiency, the auditor judges thepracticality of controls in terms of their costrelative to their intended benefit.

8 It is notintended that the auditor should evaluate ad-equacy or effectiveness in absolute terms, nor isit intended that the auditor judge efficiency inabsolute terms. An Internal auditor s evaluationof efficiency is restricted to the controls them-selves and does not extend to the measures ofoperating performance associated with the func-tioning of such controls. In judging efficiency,the Internal auditor must conclude whether thebenefits provided by the controls exceed systems of control and not the control : Supplement on Internal AuditingMay 2006 Commercial Bank Examination ManualPage 2 Provide reasonable assurance that assets aresafeguarded, information (financial andother) is timely and reliable, and errors andirregularities are discovered and control : Supplement on Internal Bank Examination ManualMay 2006 Page Promote operational efficiency.

9 Encourage adherence to managerial policies,laws, regulations and sound for policy implementation are also respon-sible for the design and the maintenance of thesystems of control . Internal auditors are respon-sible for that management function which inde-pendently evaluates the adequacy, effectivenessand efficiency of the systems of control . Internalauditors should make sure that those who relyon their opinions understand that no practicalsystem can guarantee the quality of act as a positive force to facilitatesuccessful operations as well as a negative onethat restricts activities. Accordingly, the auditorshould evaluate control systems in terms of theincentives they provide as well as the assets relates to physical, legaland all other protective means by which theorganization assures the full realization of information should be subject to thesystems of control .

10 Timely information is thatwhich anticipates a decision need and is avail-able to the persons who will use it when theyneed it. Reliable information provides a soundbasis for decision because of the authenticityof its source, the manner in which it isrecorded and the form and content of systems of control must detect and cor-rect errors and irregularities when preventivecontrols fail. Sound systems of control containsafeguards that will counteract failures in systems of control should promoteoperational efficiency. The features of controlsystems that promote operational efficiencyinclude the processes used to select and trainpersonnel, establish procedures, set performancerequirements, measure results and policies, laws, regulations andsound fiduciary principles establish boundswithin which the organization can conduct itsbusiness.