I have to create a risk assessment for our remote capture product and I’m not sure where to start. Does anyone have any info they would be willing to share on creating a risk assessment for R/C? anything would be a big help.

Maybe I should ask if anyone has a general risk assessmsnt for products thay would be willing to share?

Not for RC.

I added the remote capture product to my "Proof" audit (although it's not really "proof" anymore. And have changed my Proof audit area risk assessment to reflect this new product offering.

I tend to think of RD as a product, and not a new audit area. So in terms of audit planning, I added this new product offering with an audit area that would cover it. Hope that makes sense.

Check out the newly issued FFIEC Guidelines and the webinar next week by BOL. Maybe it will help. My question is as an auditor am I expected to go onsite and make sure the merchants are doing what they said they would do such as storage and destruction, signage, etc? Any thoughts? Or do we just assume because they said they would abide by the NACHA rules and our contract that they are doing what they should? I see some big liability questions for our bank.

We have one customer who signed up for Remote Deposit Capture through a merchant processing vendor. He scans his checks and the file is sent to the merchant processor. The merchant processor sends it to a large commercial bank. We simply recieve the ACH credit from the other bank for his deposit. We have read the FFIEC guidelines on risking remote deposit capture and we just can't see how it applies to us. In my opinion we are not doing remote deposit capture. Does anyone have any thoughts?

If your customer decides to deposit a check remotely and to also deposit the paper check with you, both deposits are on your books. When the maker identifies the problem, one will be charged back to your account whether you still have the funds or not.

Your customer, your risk.

Al

Good Point Al. I had not thought of that. Thanks

Check your pm

Ok - so I have read that one of you is including the audit of rdc with proof - is anyone else doing a separate audit? If so, would you be willing to share the audit program?

We are working on this and have a consultant working with us - he has sent a proposed audit plan - it is 8 pages long and seems to be awfully long. I am not sure it is feasible for me to complete.....

We are performing a separate Remote Deposit Capture Audit that I budged for 40 hours. It consists primarily of internal control questionnaires (ICQ), reviewing the existing policy and procedures, reviewing a sample of customer contracts, reviewing the underwriting and approval process, and ensure training was provided to the customers. Send me a pm and I am happy to share our program and ICQ.

This is what I am working on now. We do not offer RDC to our customers. We do imaging using a CAR reader that puts all transactions into electronic format, which allows us retain all of our transactions. Does anyone have an audit program they are willing to share detailing the audit process? Internal controls is a big area for this. We have 4 locations. At the main office, the accounting department scans the work. At the branches the full time tellers scan the work. How do I determine that proper internal controls are in place? Do you review work that has been scanned? If so, how much do you look at? Thanks to anyones help!

Derrick is there anyway you can send me your program?
Thanks

Derrick is there anyway you can send me your program?
Thanks

Is anyone else struggling with seperation of duties with implementing branch capture where tellers are imaging their own work?

I have completed a seperate risk assessment, internal control questionaire and audit for our RDC. We have 4 branches where the tellers are scanning their work and we also have 2 customers that are using RDC at their business. I have used the FFIEC guidelines and info from BITS. I have my proof in another audit-I combine it with my Information Technology audit. I am working on my RDC audit at this time-I have gone into our imaging system and looked at the work from the branches as well as the two business' to check for any discrepacncies. I also have planned visits this afternoon and tomorrow to our 2 customers to ensure they are complying with the agreement.

Would you like to share your risk assessment, ICQ, and audit program? If so, please PM me and I will give you my e-mail.

I would greatly appreciate if someone would share audit procedures for Remote Deposit or remote capture.
Thanks
lfries@plantersbankonline.com

Happy Drugs could you share your RDC Audit information with me? Please pm me if you are willing.

Thanks a ton!