Help! I've just discussed an audit report with management, and I can't answer one of their questions! One of my findings, based on an ICQ, states that signature cards are not designated closed at the time of closing. Now they want to know why and I don't know!! Any answers will be helpful! Thanks!

Do the signature cards relate only to a single account, the account that has been closed?

If so, who completed the ICQ? Ask this person to explain to you the procedures used when an account is closed in so far as it relates to the signature cards.

Yes, the signature cards are for a single closed account. Approx. twice a year, they pull the signature cards for all closed accounts and store them separatly.

I'm a bit confused by your question, so I will give my input based on how I've interpreted.

1 - Depending on the system you are using to file signature cards on closed accounts, you may not be able to easily purge them when your retention period is up. Clearly indicating the account has been closed and the date it closed on the card itself would help with this task.

2 - A signature card on a closed account that is not "voided" in some manner could present control issues. A dishonest employee could use the card to their advantage which may not be recognized easily if it were placed back into the "active" or "open" cards.

3 - Administratively, employees may be tempted to use an older signature card vs. a new one if a previous customer closes an account and comes in at a later date to open a new one (been there - seen it happen ). It could also result in a mess if cards are mis-filed and you do not have a distinction between closed and active cards. The integrity of the entire signature card system could be questioned if a closed card is found in the active cards - and vice versa.

These are just some issues that I could present if I were challenged with this question. I probably wouldn't consider this a "significant" finding and there may be mitigating controls to offset what I have just presented.

Always remember, the ICQ is a baseline for the audit. Just because they have answered "No" doesn't necessarily mean there are weaknesses. You just start from there, consider the risks and control objective, and then determine whether your bank has addressed them in any way.

I hope I have understood your question and provided some assitance. Good Luck!

This brings up an interesting point...never send out an ICQ or any other type of information request that you don't fully understand. I've done it, and when you can't explain the question you're asking or explain why you are requesting certain documents, you lose credibility. Even worse to state a finding that you don't understand.