Our audit company has recommended that we review our file maintenance reports.

These reports are quite lengthy. What kinds of things should we narrow in on for a review? We are already looking at address changes to make sure we have the customers authorization to do so. What should we look for on the lending and deposit side of things?

What about ownership (name additions/removals) changes? At one of my prior banks, we required customer authorization to have his/her name removed if the account wasn't being closed. Had a signed document to do so.

We have an online log which is incredibly long, however we also have a parameter report which is fairly short and a file maintenace log which is also fairly short. Maybe there is another report available or one which can be written to narrow your scope.
The file maintenance report is reviewed for various changes including mail status and address changes.

In my prior life I worked as a consultant for a CPA firm doing Internal Audit for community banks. One of the things we looked at were file maintenance reports, which could be quite lengthy, so we focused on more critical changes. On the deposit side we looked at address changes, interest rate changes, dormant status changes. On the lending side we looked at interest rate changes, advances of next due dates, and advances of maturity dates.

A couple of thoughts:

First, what management did here was look at it from a risk perspective. What critical changes can be made? Things like address, interest rate changes, etc. Unfortunately, every little thing appears on the general file main. report, ie - changing the name John to Jon and you have a 'file maintenance' activity. From a risk perspective, who cares?

Our file main. reports also listed any new activity as 'maintenace' since the system was going from nothing to something. After talking to ITI we got these changes weeded out and put on a separate report and it almost cut the reports in half+.

Finally, I've been told that there has been rumblings that ITI has been getting pressure to create a separate 'address file maintenace report,' much like they have for their 'rate changes' report. I think management told me it was expected by the end of 2009!

In addition to the reports listed, We also review the changes made to ACH, password, dormant, Reg CC changes.