We were recently examined by FDIC and all they could do was complain that we did not have an Internal Auditor. We are a small community bank that cannot afford to go out and hire someone. I am looking for any kind of "cheat sheets" that other bankers have used in setting up an Audit program in any area of the bank.

You need to outsource the function. Get a firm of CPAs to do periodic reviews for you, you'll get an independent view and not have the costs of a full time hire.

Check your PM, I just sent you one.

The supervisors' unabating focus on institutions having a formalized internal control process -- but particularly this drumbeat being heard from the FDIC -- is happening everywhere. While they technically can't mandate this internal control process for institutions under $500 million, they nevertheless are making the recommendation anyway -- and in those cases where bankers complain, the FDIC ombudsman is apparently siding with the examiners. One thing that no supervisor can tell you is HOW to design the internal control process; i.e., they can't say you must HIRE an internal auditor ... versus engaging in a co-sourcing arrangement or outsourcing arrangement with an internal auditing. I would agree with the previous posting and encourage you to engage the services of an internal auditing firm/consultants that specialize in banking internal control. Anyone that's been through this will tell you the drumbeat is incessant; and the home-made questionnaires and ICQs you're trying to create are like hand-filling sandbags against the Mississippi.

Outside audits MIGHT be less expensive in some cases, however, that was not the case with my previous employment. At that bank (600 million)I was Compliance Officer and Compliance Auditor. We wanted to separate the two funcitions. The CPA firm we talked with gave us a figure for quarterly audits that exceeded my salary at that time! Additionally, I would be working with them, preparing for their quarterly visits, responding to their reports and ensuring all deficiencies would be corrected. We decided to distribute some of the daily Compliance monitoring functions to our Deposit Operations and Loan Operations rather than incur that additinal expense. We (they) just completed an exam in early Oct (FDIC Compliance) and the examiner was happy with our set-up.

You have several options...

1) Hire a full time internal auditor.

2) Fully outsource the internal audit function.

3) If you have a qualified person (thoroughly familiar with audit and internal control) in house, but can't justify the full time position, you might get them to coordinate the internal audit function. Specific activities can be allocated to different individuals in the bank. For example, someone on the lending side could do the audit procedures for deposits. Someone in deposits could do the audit procedures for lending. Etc., etc. As long as the person performing the procedures are qualified and independent, this is a workable solution. Key words...qualified and independent.

4) Similar to number 3...but if you don't have a qualified candidate to coordinate the function, but do have sufficient staff (qualified and independent) to perform all or some of the individual audits, you might get a third party firm to help design the audit program, including audit procedures and checklists. The third party can coordinate the program, with much of the work done by existing staff. The third party could fill in the gaps where you don't have the resources or expertise internally (i.e. IT).

First, sorry I have not gotten back on this but we had a bigger issue with Flood Determination, actually civil money penalty. We are $80m with two locations, main office and a branch that opened September 2002. We do have our CPA do an external audit each year, but they are still requesting that we set up internal controls to monitor during the year. I feel like they will take our work papers and use them and still charge us for the same service. If we could get sample work papers and maybe a copy of policy, we could use that to start with. I just can't see us getting to deeply involved in this since we are a small community bank, with only 27 employees.