Has anyone had a red flag audit. We are expecting to have examiners in Januray. I have the policy/procedures and have done my annual repor to the Board. I am looking for some insight on comments from examiners and what they were looking at.

My experience is that they review your policies and procedures. I have yet to have a bank in which they performed actual transaction testing.

You will want to be sure the Service Provider (Vendor Management) piece of your program is documented (example: what steps did you take to ensure your critical vendors have assured they have ID Theft provisions in place to protect the security and confidentiality of information they have access to).

We had our infernal auditors looking at our red flags. All they could find is that the procedures to follow for some red flags did not match the procedures in policy manuals. Sometimes you change procedures but forget everywhere those procedures are listed. SOOOO I changed the red flag procedures that employees are to follow when encountering a red flag to read as follows:

Follow the procedures that have been developed, approved, or implemented by the board of directors, senior management, management, or supervisors and communicated to First National Bank employees and or officers through bank policies or manuals; department manuals, or procedures; or communicated either written or verbally to you.