How is the annual ACH audit performed at your organization? The internal audit department here does not have the knowledge or expertise to perform this audit and I thought I read somewhere that it is more of a self-audit, that management or senior management can perform. Is this true?

There is an ACH Self Audit Guide that can be obtained from MPX that outlines everything you need to do.

In the past, we learned it as we went along. Our ACH association offered great guidance which was helpful in performing the audit. We have outsourced IA now and they don't do it. This year, we tried to have mgmt perform the self audit but it wasn't working well and I (ex-IA) ended up performing it. The audit steps are relatively easy to follow. I think Appendix 8 in the ACH RULES book outlines them pretty clearly. Once you get the vocabulary down, its not as hard as you think. The ACH Risk Management Handbook is also very handy to have as a reference. Good Luck!

Did you perform a risk assessment on the ACH Audit?

The ACH Audit guide is the way to go. Can be ordered from www.mpx.org. The guide gives you all the required checklists, audit steps etc. When I started doing the annual audits about 3 years ago, I knew zip about ACH. But by using the audit guide, having the NACHA rulebook handy, and talking with the auditee, I feel like I have developed a good base of knowledge. I order a new book each year to make sure I am aware of any changes that have taken place.

I haven't been responsible for the NACHA-mandated annual self-audit, but I've done bank-mandated quarterly departmental audits, and on that level, one of the things that I really key in on is the documentation pertaining to changes to the ACH database (we're using a PEP+ system) and to any reversals or item/batch deletions or the resets of batch suspensions (due to risk limits or other factors). In my experience, it's critical that the ACH staff NEVER do anything to an item unless they have a piece of paper in their hands that gives them specific authorization to undertake the action. (I basically take the Teamster approach of "Hey, I don't even scratch my butt without a work order.") Phoned requests or other verbal requests shouldn't cut it. I don't even like using email requests--I prefer that dedicated forms be submitted and that the approvals come from known and authorized personnel.

I can't harp on this issue too much. I've been burned too often by customers trying to claim weeks later that they never told us to reverse an item or kill a batch or whatever. Always document your actions, and in your audit, pull some examples of reversals and deletions and resets and such and make certain that all the paperwork can be located.