An auditor is telling us that we need to have a separate policy for mobile banking. We actually have it incorporated with our internet banking, because it uses the same platform. You use the same credentials, security features and options of our OLB. I could understand if it was separate to that but it is not. Is this a requirement or what do most banks do? Thanks!

What is their stance for this policy requirement? Ask them to site the requirement. Ours is included in our electronic banking policy.

What ^^ said. You "need" to have this why, because they believe it is a regulatory requirement, or because what you have is not working, or it is their opinion? Your response would be based on this.