We had an independent third party to review out BSA policy in Dec 2007. Then we had the NCUA and DFI here to review our BSA policy in April 2008. Do we have to have an independent third party here to review us again in Dec 2008 or does the NCUA and DFI count as an independent third party? Can we now count 12-18 months from April 2008?

Thanks for your help!

Your regulatory exam does not count as your independent testing. The examiners will review results of your independent audit as part of their exam. Therefore, your 12 -18 months timeframe would be from 12/07.

Just to add to what Diva said.
Depending on your regulator interprets "Periodic", in the requirement to have "Periodic" independent testing.
I hear that some agencies are sticklers that it means 12 months, and some others that will allow 12-18, if all is well.

For sure...anyone who goes 18 months between independent audits had better have a really clean program.

We like to do our independent review every 12 months or so. We try to time it so it falls about 6 months after the regulatory audit. That way, if anything were found by either the regulators or independent auditors, we have time to address it before the next audit. It seems to work pretty well for us.