What are some ways that I, as internal auditor, can conduct social engineering testing? Our bank is a small bank with no branches.

The first thing that comes to mind is to see if you can get an employee to give you their password.

"I'm the auditor and I need to test your password."

A couple, hopefully, simple ideas.

Generate emails intended to lure individuals to a suspicious website designed for your specific engagement. For example, send a link to a sample of people to conduct a satisfaction survey. Use surveymonkey.com or something similar, by setting up an actual survey so you can see if employees actually respond. While this is a legitimate site, employees should know to be suspicious of hyperlinks in emails, particularly if employers have not notified employees of the upcoming survey.

Impersonation of people such as customers or vendors to gain information through telephone conversations with various personnel. For example, from an external phone, call various employees and impersonate a customer and try and obtain confidential information, or say you're a consultant working with IT and need to confirm certain settings on their computer (e.g. systems used, passwords to those systems, step them through finding the software version, service pack, and product ID information for key programs.

Also Google 'social engineering examples' and you'll be amazed at what you find. Have fun and good luck!

We had our IT guys set up an email that went to all employees, purportedly from the HR Officer requesting that you fill out a form to update your personnel file. It also asked for your network log-in and user ID. Funny thing about filling out a random personnel form that appears legit - we had people that filled in their log-in and user ID and called after they hit the submit button to see why they needed to provide those piece of info. "Um, you don't. Ever."