In a nutshell my question is whether the standards, or roadblocks, for a large public accounting firm to perform a BSA audit differ from those of a consulting or auditing company who is not a public accountant. I’m unaccustomed to seeing BSA audit reports which reference AICPA, SEC and PCAOB standards in the body of the report with language which specifically states that the BSA review was conducted in accordance with AICPA standards. I also find it unusual that the BSA audit/review would need to specifically state that the party conducting the review “did not examine any internal controls as defined by the AICPA” and that “no opinion on such controls can be made”. I thought that review of the BSA internal controls was one of the primary tenets of a BSA audit. Finally, I also find it unusual that the BSA audit would be contain the public accounting firm’s “Peer Review Report”, including copies of the communications from the National Peer Review Committee as an appendix to the BSA Audit Report. The FDIC’s Section 363.3(f) has an “Independence” requirement which seemingly requires an independent public accountant to comply with the independence standards and interpretations of the AICPA, the SEC, and the PCAOB. My interpretation is that Section 363 applies to public accountants that are auditing the financial statements of a bank and would not apply to the provision of all services such as a BSA audit or a Compliance Lending audit.

It would not be performed as an attestation audit, so without actually reviewing the report, it does appear a little unusual to include all of that information. I work with a CPA firm on some audits and their reports for BSA and other compliance areas look much different than their financial audit reports.

Al always, thanks Mr. Carey.

One last question Mr. Carey or anyone. Since public accounting firms which conduct an external audit of a bank's financial statements can't conduct outsourced audit work for the bank, it would appear problematic for the accounting firm to issue a report called the "BSA Audit Report" for the bank. Can the public accounting firm, which audited the bank's financial statements, perform what is typically considered a BSA audit and release it under the name: "BSA Independent Review" in order to fulfill the bank's requirement for a periodic independent review of its BSA Program?

It depends on the size of your institution ($500MM) and the attitude of your examiners.

The regulations require an independent BSA "examination," not an "audit."

While I cannot figure out what's going on here, you seem to feel there is some conflict of interest on their part in doing the independent examination in addition to the other work they do for your bank. If that's true, ask them for another piece of the boilerplate they seem so fond of, a statement that there is no problem with their provision of both services. If they balk, then you have matured the issue.

This problem would have been best addressed in the engagement letter...

Good point Ken - I've seen many of the annual BSA reviews entitled "BSA Audit" which skewed my earlier point. I agree that an examination is called for instead of a, per se, audit. It's the following sentence from the OCC Handbook section on Internal and External Audits that gives me some concern: "Therefore, from a safety and soundness perspective and in keeping with regulatory requirements, the OCC prohibits registered national banks and national banks subject to 12 CFR 363(regardless of whether they are registered or not) from outsourcing internal audit work to the same external audit firm that performs a bank’s financial statement audit and other attestation services.”

OCC Comptrollers Handbook “Internal and External Audits [Page 30] “When one firm or vendor performs both financial statement audit services and outsourced internal audit services for a bank, the firm or vendor risks compromising its independence by being placed in a position of appearing to audit, or actually auditing, its own work."

The Examination Manual treats the words like they are synonyms as well.

Page 11:As part of the scoping and planning process, examiners should obtain and evaluate the supporting documents of the independent testing (audit) of the bank’s BSA/AML compliance program.

Page 23: Independent testing (audit) should review the bank’s risk assessment for reasonableness.

Page 30: Independent testing (audit) should be conducted by the internal audit department, outside auditors, consultants, or other qualified independent parties.

There are many other examples there, but I would expect a CPA firm to shy away from calling it an "audit" in favor of a more ambiguous term, the one actually used in the regulation.

"subject to 12 CFR 363"

There is your key and why I earlier mentioned asset size.