I am currently shopping for an audit management software program. I'm looking for a system that would automate the entire audit process (risk assessment, scheduling, workflow, report preparation, follow-up tracking). So far I've identified the following systems:

Audit Leverage
CCH TeamMate
AutoAudit

Is there anyone out there who currently uses one of these programs? I'd be interested in hearing feedback - good or bad. Does anyone know of any other programs I should consider?

Thanks!

Are there any of these programs which are aimed specifically at banking - or are there any audit management softwares aimed specifically at banking? Also, are any of the softwares aimed at paperless files?

The three systems I mentioned above are not specific to banking. The functionality of each is very similar, but you would have to configure it the way you intend to use it (i.e. define your auditable areas, establish your risk assessment criteria and definitions). You would also need to populate it with your own audit programs/procedures. But, you can fairly easily import that. So, there would definitly be some setup and implementation lag time before you could effectively start using the system.

If you're looking for something more specific to banking you should check out Compliance Pro from American Bank Systems. It comes full of content (Internal Control Questionnaires, Checklists, Audit Procedures, etc.). The setup wouldn't be nearly as complicated. However, it is more of a compliance monitoring system rather than an audit managment system.

All of these programs have the ability to create paperless files. In other words, you could attach files directly to the audit procedure or issue/exception to which they relate.

I have not used it, but I've heard AuditAlert automates the process.

We use AuditAlert (B4nAfter.com). It is completely paperless and is an automated process - it was primarily designed for banks (but other industries are using it too). When I did research on this last year, the reason I selected AuditAlert was because it is not only an automated process for the auditor, but for the auditee. The other three you mentioned are not automated for the audittee.

For instance, we develop our ICQ and then assign each question to an audittee. Once finalized, we click on submit and the audittee rececives an email. They click on a link and it takes them to the questions assigned to them. They simply click on the answer and may enter explanations for their answers. I get notified once all questions are completed and AuditAlert sends a reminder to the audittee if they do not respond by the deadline (nice feature).

They do not provide workprograms or ICQs, but otherwise, the entire process is automated for the auditor and audittee.

So if the software does not provide workpapers or ICQ's do you have to create your workprograms and ICQs in the system before you can proceed to the actual completion of the audits using the software? Do you work for a bank or for a firm who audits banks? Also are you part of a department or a sole auditor?

If you would rather answer these questions privately you can pm me and I will be more than happy to provide you with an email address.

No problem. Yes, in the initial year, we had to create all of the workprograms and ICQs. We used a few AlexInformation and Sheshunoff products (in Word on CD so easy to copy / paste into AuditAlert) and we tailered them to our bank. But, after the initial year, the workprograms and ICQs carryforward to the next year and then we just need to make any modifications as needed.

We are an internal audit department of four for a $1.5 billion bank.

Our trouble spots are tracking exceptions and auditor time budgets. Does Audit Alert use auditee automation for that as well? We are still using Excel outside of audit program for this.

Thanks for the web address.

My other suggestion for the original poster: Make sure your IT guys are happy with whatever you buy.

Good question. Yes, my audit team enters their time daily now by audit project. It also allowed me create customized admin time codes (vacation, training, sick/personal, department meetings, bank-wide management meetings, etc.) and it generates a nice report for me (budget vs. actual) that I provide to the Audit Committee quarterly.

We document audit findings and once we "release" it, it goes to the auditee via email. They click on a link and the auditee provides their management response and they develop their action plan (e.g. implement xyz procedure by 10/31/08). Then, each quarter, AuditAlert asks them to update their action plan until the matter is completely resolved or fully implemented. So, yes, fully automated.

Basically the following is automated: Audit risk assessments, self-assessments performed by management, audit planning for the year, time tracking, audit finding tracking, exam reports, review notes from you to your staff, ICQs, audit programs, request lists, regulatory examination preparation.

My only complaint about AuditAlert is the attractiveness of the audit reports. It pulls all of the information in automatically (audit objective, scope, timing, limitations, findings, finding ratings, overall rating, etc.) which is nice, but I do not like the format. So, I let AuditAlert generate the audit report and then I tweak it to make it a little more attractive (add our logo, move some things around, etc. But, this only takes 5 or so minutes per report - so I'm still saving a lot of time.

One more nice feature I didn't mention previously - when you receive notice that a FDIC/OCC/OTS/Fed Reserve exam is coming up. You can convert their request list letter and questionnaires into AuditAlert and assign the requests to various employees. They provide the information electronically into AuditAlert. Once everything is received in AuditAlert, you can easily convert it into a file to provide to the examiners. We tried it this past March for FDIC and the examiners loved having everything electronically in one organized file.

We use CCH TeamMate. It has five main components:

-TeamRisk for audit universe risk assessment
-TeamSchedule for project and resource scheduling
-TeamMate Tec for time and expense capture
-TeamMate EWP which is where you will perform your audits and store electronic work papers
-TeamCentral for project and exception tracking

There is also a teamstore which stores workprograms and other templates such as reports and engagement memos that are used frequently.

Let me know if you have any questions!

DBanker27, do you find you have trouble with TeamMate's follow up tracking & reporting capability?

At the close of each audit, we specify the status of each exception and if we will follow up or re-test that step. We run reports out of TeamCentral that show which exceptions are still outstanding. We will review all outstanding excpeptions at least quarterly, follow up and post notes in TeamCentral and update the status.

As far as reporting, there are a wide variety of reports available in Teammate. You can generate final audit reports, exception summaries, audit program test steps, exception tracking and many more. Each week our department prints out a time report showing how many hours have been spent on each project and variance against the budgeted hours.

This is the only audit software I have used, so I can't compare it so something else. Overall, the program effectively meets the needs of our audit department. I like Teammate and how much information is instantly accessible versus old paper files.

Let me know if you have any other questions!

I'll have to check to see what version we're using. We have the exception reporting and follow up functionality you described, but we find it to be horribly inconsistent and not comprehensive. We end up tracking everything manually to ensure we're not missing things. Very cumbersome and frustrating given the cost of the application.

Thanks for the info!

I'm still tracking in Excel, too. I love the EWP portion, but exception tracking and time management has been easier in Excel. I think "very cumbersome" describes it well.

Ok - I know this is somewhat unrelated but I have to pose this question - do you all know of a software package available to document and assess a bank's internal controls?

The AICPA just released ControlsDoc which is program that will do this, however, it is not geared toward banking. I have tried to locate one on the internet but can't seem to find one.

Also, if anyone has used a program to do this please let me know.

Thanks,

Kendra

We use audit leverage to automate our processes and so far is working okay.

We're looking to upgrade to AutoAudit 3.5, is anyone using this version?

We're also looking at TeamMate if any is interested in sharing their thoughts, please PM me.