We're a 3 year old bank and have outsourced auditing. Our auditor prepares a draft and submits it to management for reaponse (30 days), then the audit, with integrated responses is sent to the Audit Committee chair. For the most part (90%), the response indicated completed or corrected.

The OCC is in, and wants to cite the bank for not maintaining a progress log, reflecting the severity of the exception. In an e-mail exchange, the OCC examiner stated, "We do not consider the audit alone with a management response to be adequate. It is necessary to have a tool that addresses management response, date corrected, follow up audits if required, risk to the bank, etc... "

We got away from a log as it was time consuming and provided minimal additional benefit.

Do you maintain a log?
Is it beneficial?
Is it mandated by regulators?

Thanks

We maintain an audit tracking database that addresses management response, commitment date, date of follow up testing, and if additional follow up is necessary. My bank is rather large and we find this tool useful.

I would say that unless the OCC found significant weaknesses in the audit process, such as management responses that were not adequate, untimely or ineffective corrective actions taken, or the lack of appropriate testing follow-up, this should be a recommendation rather a direct citation in the ROE. If the process is not broken, IMHO they have a hard time saying that your process is not "adequate" unless there are these other contributing factors. If this is going to make the report, I would be kicking it up a notch if you can justify that these other factors are not currently present. At the same time, I would acknowledge that it is however a sound recommendation and that you will implement such a tracking system. Almost all bank use them so that things don't inadvertent fall through the cracks.

If that were the case, I wouldn't disagree. There has never been an audit repeat finding, the Chair of the Audit Committee is a CPA, and having audited banks, knows what is serious, etc.

As a denovo, there are a lot of minor recommendations for enhancements (workflows), and along with findings are scheduled for response. If the AC wants it, it will be done, but the case appears to be form over substance.

Examiner's findings are many times form over substance

Personally, maintaining a log has helped maintain my sanity.

I have one log that summarizes each audit area, the finding in the audit, the response, and the risk grade for that audit area. It is in an excel spreadsheet, each month is a seperate tab, and I have them going back to 2001, with a seperate one for each year. Our board reviews this quarterly.

Then a second log is maintained of pending, tracking, or repeat items. Is there a "finding" that for whatever reason was not officially noted in my report, I will track that here for the next audit. Was there a finding with a specific due date? I will track that here too. Was there something that we talked about in Audit committee with a specific due date, that will be tracked here too.

Then my 3rd log is the same as the second, but with only Freddie Mac findings. They requested this the last time that they were in. Either that, or they said I'd need to be mentally tracking it all

Thank all of you. There is a lot of good advice here!

We are a $1+ billion bank and we formally track all repeat findings and high priority rated findings.

A management response is usually something like, "we will develop a new checklist and implement it by the next quarter"; whereas for tracking, you follow up to ensure they actually implemented their original action plan.

As this approach was approved by our Audit Committee, we haven't (so far) been criticized by the state or FDIC.

I would love to see your audit log, if you're willing to share it. Let me know and I'll get you my email address.
Thanks!
gigib

Ditto. It helps me to follow up.

Perfect example came into play this week. Management's response indicated that they would begin producing and reviewing some report back in May and noted it as being corrected in the response. I added the item to the log, then when I went back to verfiy this was being done, I got an e-mail stating that mangement had never started producing the report.

So I think the log will help YOU more than anything, but also remember that follow up is a necessary step in the process. Taking someone's word for something could come back to bite you, even though management's oversight was unintentional.